#!/bin/sh
set -eu

PROJECT_ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
YAZA_CLI=${YAZA_CLI:-"$PROJECT_ROOT/dist/yaza"}
case "$YAZA_CLI" in
    /*) ;;
    *) YAZA_CLI="$PROJECT_ROOT/$YAZA_CLI" ;;
esac

if [ ! -x "$YAZA_CLI" ]; then
    printf '%s\n' "YAZA CLI is not executable: $YAZA_CLI" >&2
    exit 1
fi
if ! command -v jq >/dev/null 2>&1; then
    printf '%s\n' "jq is required to validate SARIF JSON in this smoke test." >&2
    exit 1
fi

TEMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/yaza-audit-sarif.XXXXXX")
cleanup() {
    rm -rf "$TEMP_ROOT"
}
trap cleanup EXIT HUP INT TERM

FINDING_ROOT="$TEMP_ROOT/findings"
mkdir -p "$FINDING_ROOT/config with spaces"
printf '%s\n' 'verify_tls = false' 'API_KEY = "yaza-test-secret-do-not-print"' > "$FINDING_ROOT/config with spaces/naïve%?#.toml"
(
    cd "$FINDING_ROOT"
    if "$YAZA_CLI" audit --security --format sarif > "$TEMP_ROOT/findings.sarif"; then
        printf '%s\n' "SARIF audit did not return the finding status." >&2
        exit 1
    fi
)
jq -e '
    (.version == "2.1.0") and
    (."$schema" == "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json") and
    (.runs | length == 1)
' "$TEMP_ROOT/findings.sarif" >/dev/null
jq -e '
    . as $document |
    ($document.runs[0].tool.driver.name == "YAZA") and
    (([$document.runs[0].tool.driver.rules[].id] | index("YZA-SEC-003")) != null) and
    (([$document.runs[0].results[].ruleId] | index("YZA-SEC-003")) != null) and
    all($document.runs[0].results[]; . as $result | $document.runs[0].tool.driver.rules[$result.ruleIndex].id == $result.ruleId)
' "$TEMP_ROOT/findings.sarif" >/dev/null
jq -e '
    .runs[0].results[] |
    select(.ruleId == "YZA-SEC-003") |
    .level == "warning" and
    .properties.yazaSeverity == "high" and
    .properties.confidence == "medium" and
    .locations[0].physicalLocation.region.startLine == 1 and
    (.locations[0].physicalLocation.artifactLocation.uri | contains("config%20with%20spaces/na%C3%AFve%25%3F%23.toml"))
' "$TEMP_ROOT/findings.sarif" >/dev/null
if grep -F 'yaza-test-secret-do-not-print' "$TEMP_ROOT/findings.sarif" >/dev/null; then
    printf '%s\n' "SARIF output leaked a candidate secret value." >&2
    exit 1
fi

mkdir -p "$TEMP_ROOT/clean"
(
    cd "$TEMP_ROOT/clean"
    "$YAZA_CLI" audit --security --format sarif > "$TEMP_ROOT/clean.sarif"
)
jq -e '.version == "2.1.0" and .runs[0].results == [] and .runs[0].properties.findingCount == 0' "$TEMP_ROOT/clean.sarif" >/dev/null

DEEP_ROOT="$TEMP_ROOT/deep"
mkdir -p "$DEEP_ROOT"
DEEP_PATH="$DEEP_ROOT"
depth=0
while [ "$depth" -lt 33 ]; do
    DEEP_PATH="$DEEP_PATH/d"
    mkdir -p "$DEEP_PATH"
    depth=$((depth + 1))
done
(
    cd "$DEEP_ROOT"
    if "$YAZA_CLI" audit --security --format sarif > "$TEMP_ROOT/deep.sarif"; then
        printf '%s\n' "SARIF audit failed to report its scan-depth limit." >&2
        exit 1
    fi
)
jq -e '
    .runs[0].results[] |
    select(.ruleId == "YZA-SEC-999") |
    (.locations[0].physicalLocation.region == null) and
    (.locations[0].physicalLocation.artifactLocation.uri | endswith("/d"))
' "$TEMP_ROOT/deep.sarif" >/dev/null

if "$YAZA_CLI" audit --security --format xml > "$TEMP_ROOT/invalid-format.log" 2>&1; then
    printf '%s\n' "Security audit accepted an unsupported output format." >&2
    exit 1
fi
grep -F 'Usage: yaza audit --security [--format json|sarif]' "$TEMP_ROOT/invalid-format.log" >/dev/null

printf '%s\n' "Security audit SARIF smoke passed."