#!/usr/bin/env bash
set -euo pipefail

root="$(git rev-parse --show-toplevel)"
ags="$root/x/agent-git-service"
suffix="$$-$RANDOM"
allowed="$ags/internal/service/zz_repositorymutation_probe_$suffix"
denied="$ags/internal/githttp/zz_repositorymutation_probe_$suffix"

cleanup() {
  rm -rf "$allowed" "$denied"
}
trap cleanup EXIT

mkdir -p "$allowed" "$denied"
cat >"$allowed/probe.go" <<'EOF'
package boundaryprobe

import repositorymutation "github.com/pingcap/agent-git-service/internal/service/internal/repositorymutation"

var _ = repositorymutation.NewOwner
EOF

cat >"$denied/probe.go" <<'EOF'
package boundaryprobe

import repositorymutation "github.com/pingcap/agent-git-service/internal/service/internal/repositorymutation"

var _ = repositorymutation.NewOwner
EOF

(
  cd "$ags"
  go test "./internal/service/$(basename "$allowed")" >/dev/null
)

set +e
denied_output="$({ cd "$ags" && go test "./internal/githttp/$(basename "$denied")"; } 2>&1)"
denied_status=$?
set -e
if [[ $denied_status -eq 0 ]]; then
  echo "AGS repository mutation boundary: githttp imported the private owner" >&2
  exit 1
fi
if [[ "$denied_output" != *"use of internal package"*"not allowed"* ]]; then
  echo "AGS repository mutation boundary: unexpected denied-probe result" >&2
  echo "$denied_output" >&2
  exit 1
fi
rm -rf "$allowed" "$denied"

if rg -n 'internal/service/internal/repositorymutation' \
  "$ags/internal/githttp" "$ags/server" --glob '*.go' --glob '!**/*_test.go'; then
  echo "AGS repository mutation boundary: outer packages import the private owner" >&2
  exit 1
fi

echo "AGS repository mutation private import boundary passed."