#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
CHECK="${SCRIPT_DIR}/check-electron-cutover.sh"
FIXTURE="$(mktemp -d)"
trap 'rm -rf "${FIXTURE}"' EXIT

mkdir -p \
  "${FIXTURE}/desktop/internal/api" \
  "${FIXTURE}/desktop/electron/src/main" \
  "${FIXTURE}/desktop/electron/src/preload" \
  "${FIXTURE}/desktop/electron/src/shared" \
  "${FIXTURE}/desktop/electron/build" \
  "${FIXTURE}/desktop/release" \
  "${FIXTURE}/web/src/runtime/desktop" \
  "${FIXTURE}/web/src/entries"

cat >"${FIXTURE}/desktop/go.mod" <<'EOF'
module example.test/desktop
EOF
cat >"${FIXTURE}/desktop/internal/api/router.go" <<'EOF'
package api
EOF
cat >"${FIXTURE}/desktop/electron/src/main/window.ts" <<'EOF'
export const options = {
  webPreferences: { nodeIntegration: false, contextIsolation: true, sandbox: true },
}
EOF
cat >"${FIXTURE}/desktop/electron/src/preload/index.ts" <<'EOF'
export const facade = { getBootstrap: () => Promise.resolve({}) }
EOF
cat >"${FIXTURE}/desktop/electron/src/shared/ipc.ts" <<'EOF'
const requestSchemas = {
  "desktop:bootstrap:get": z.object({ channel: z.literal("desktop:bootstrap:get") }),
}
const responseSchemas = {}
EOF
cat >"${FIXTURE}/desktop/electron/electron-builder.yml" <<'EOF'
mac:
  icon: build/icon.icns
win:
  icon: build/icon.ico
EOF
printf 'icns\n' >"${FIXTURE}/desktop/electron/build/icon.icns"
printf 'ico\n' >"${FIXTURE}/desktop/electron/build/icon.ico"
cat >"${FIXTURE}/web/src/runtime/desktop/bootstrap.ts" <<'EOF'
export const daemonBaseURL = "http://127.0.0.1:60437"
EOF

AGENTTEAM_ELECTRON_CUTOVER_ROOT="${FIXTURE}" "${CHECK}" >/dev/null

expect_rejected() {
  local path="$1"
  local content="$2"
  local expected="$3"
  printf '%s\n' "${content}" >"${FIXTURE}/${path}"
  if output="$(AGENTTEAM_ELECTRON_CUTOVER_ROOT="${FIXTURE}" "${CHECK}" 2>&1)"; then
    echo "expected guardrail rejection for ${path}" >&2
    exit 1
  fi
  grep -F "${expected}" <<<"${output}" >/dev/null || {
    echo "missing expected diagnostic ${expected}: ${output}" >&2
    exit 1
  }
  rm -f "${FIXTURE}/${path}"
}

expect_rejected \
  "desktop/internal/api/legacy.go" \
  'package api; import _ "github.com/wailsapp/wails/v3/pkg/application"' \
  "Wails"
expect_rejected \
  "desktop/internal/api/assets.go" \
  'package api; import _ "github.com/tidbcloud/AgentTeam/webassets"' \
  "webassets"
expect_rejected \
  "desktop/internal/api/auth.go" \
  'package api; const auth = "/static/auth.js"' \
  "/static/auth.js"
expect_rejected \
  "desktop/internal/api/login.go" \
  'package api; const login = "/api/internal/auth/login"' \
  "/api/internal/auth/login"
expect_rejected \
  "desktop/internal/api/window.go" \
  'package api; const route = "/api/internal/window/open"' \
  "native UI HTTP route"
expect_rejected \
  "desktop/internal/api/tray.go" \
  'package api; const route = "/api/internal/tray/unread"' \
  "native UI HTTP route"
expect_rejected \
  "desktop/release/install-webview.sh" \
  'curl -o MicrosoftEdgeWebView2RuntimeInstaller.exe https://example.invalid' \
  "WebView2"
mkdir -p "${FIXTURE}/desktop/release/client/darwin-arm64"
printf '%s\n' 'go build ./cmd/agentteam' >"${FIXTURE}/desktop/release/client/darwin-arm64/build.sh"
if output="$(AGENTTEAM_ELECTRON_CUTOVER_ROOT="${FIXTURE}" "${CHECK}" 2>&1)"; then
  echo "expected guardrail rejection for retired macOS Go release path" >&2
  exit 1
fi
grep -F "retired desktop release path" <<<"${output}" >/dev/null || {
  echo "missing retired release path diagnostic: ${output}" >&2
  exit 1
}
rm -rf "${FIXTURE}/desktop/release/client"
expect_rejected \
  "web/src/runtime/desktop/unsafe.ts" \
  'export const daemon = `${window.location.protocol}//${window.location.host}`' \
  "window.location"
expect_rejected \
  "desktop/electron/src/main/unsafe.ts" \
  'export const preferences = { nodeIntegration: true }' \
  "Node integration"
expect_rejected \
  "desktop/electron/src/preload/unsafe.ts" \
  'contextBridge.exposeInMainWorld("ipcRenderer", ipcRenderer)' \
  "generic Electron bridge"
expect_rejected \
  "desktop/electron/src/main/unsafe.ts" \
  'ipcMain.handle("desktop:anything", async () => ({ ok: true }))' \
  "outside shared request allowlist"

rm "${FIXTURE}/desktop/electron/build/icon.icns"
if output="$(AGENTTEAM_ELECTRON_CUTOVER_ROOT="${FIXTURE}" "${CHECK}" 2>&1)"; then
  echo "expected guardrail rejection for missing branded application icon" >&2
  exit 1
fi
grep -F "macOS branded application icon is missing" <<<"${output}" >/dev/null || {
  echo "missing application icon diagnostic: ${output}" >&2
  exit 1
}

echo "Electron cutover guardrail tests passed."