#!/usr/bin/env bash

set -Eeuo pipefail

readonly ROOT="$(cd -- "$(dirname -- "$BASH_SOURCE")/../.." && pwd -P)"
readonly APPLY="$ROOT/scripts/bootstrap/apply-private-dns.sh"
readonly LAN="$ROOT/infrastructure/networking/private-dns/host/dnsmasq-lan.conf"
readonly TAIL="$ROOT/infrastructure/networking/private-dns/host/dnsmasq-tailscale.conf"
readonly CORE="$ROOT/infrastructure/networking/private-dns/kubernetes/coredns-custom.yaml"
readonly BUSYBOX='docker.io/library/busybox:1.37.0@sha256:7a3ebe5bfd1a4a19797d20b0c0bb39d44393e9a03fd852c0865b0f540d868df0'
readonly -a HOSTS=(
  git.learn.hyeonworks.com
  id.learn.hyeonworks.com
  storage-admin.learn.hyeonworks.com
  db-admin.learn.hyeonworks.com
  grafana.learn.hyeonworks.com
)

fail() {
  printf 'FAIL: %s\n' "$*" >&2
  exit 1
}

pass() {
  printf 'PASS: %s\n' "$*"
}

for file in "$APPLY" "$LAN" "$TAIL" "$CORE"; do
  [[ -f "$file" && ! -L "$file" ]] || fail "missing regular source: $file"
done
bash -n "$APPLY"

for host in "${HOSTS[@]}"; do
  grep -Fqx "address=/$host/192.168.0.107" "$LAN" || fail "LAN source lacks $host"
  grep -Fqx "address=/$host/100.92.240.34" "$TAIL" || fail "Tail source lacks $host"
  grep -Fq "192.168.0.107 $host" "$CORE" || fail "CoreDNS source lacks $host"
done
pass 'all five private names are source-bound for LAN, Tail, and Pods'

grep -Fq 'PUBLIC_PRIVATE_HOSTS=(storage-admin.learn.hyeonworks.com db-admin.learn.hyeonworks.com grafana.learn.hyeonworks.com)' "$APPLY" ||
  fail 'public A/AAAA absence set is not exact'
grep -Fq 'PRIVATE_HOSTS=(git.learn.hyeonworks.com id.learn.hyeonworks.com storage-admin.learn.hyeonworks.com db-admin.learn.hyeonworks.com grafana.learn.hyeonworks.com)' "$APPLY" ||
  fail 'private resolver verification set is not exact'
grep -Fq "readonly BUSYBOX_IMAGE=\"$BUSYBOX\"" "$APPLY" || fail 'BusyBox pin constant is not exact'
grep -Fq -- '--image="$BUSYBOX_IMAGE"' "$APPLY" || fail 'Pod smoke does not use the pinned BusyBox constant'
for host in "${HOSTS[@]}"; do
  grep -Fq "nslookup $host" "$APPLY" || fail "Pod smoke omits $host"
done
pass 'apply source checks public absence and all five resolver paths with pinned BusyBox'

grep -Fq 'managed_listeners_are_exact' "$APPLY" || fail 'repeat execution has no exact managed-listener classifier'
grep -Fq 'lan_was_active=' "$APPLY" || fail 'rollback does not snapshot LAN active state'
grep -Fq 'tail_was_active=' "$APPLY" || fail 'rollback does not snapshot Tail active state'
grep -Fq 'lan_was_enabled=' "$APPLY" || fail 'rollback does not snapshot LAN enabled state'
grep -Fq 'tail_was_enabled=' "$APPLY" || fail 'rollback does not snapshot Tail enabled state'
grep -Fq 'restore_service_state' "$APPLY" || fail 'rollback does not restore managed service state'
pass 'repeat execution and rollback service-state contracts are present'

printf 'PRIVATE DNS OBSERVABILITY CONTRACT PASS\n'