#!/usr/bin/env bash
# Regression test: ArgoCD repo-server must be able to write to /var/run/argocd when
# the manifest uses hostPath-backed volumes (common on k3d nodes).

set -euo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
PROLE_HOME=$(cd "$SCRIPT_DIR/../.." && pwd)

MANIFEST="$PROLE_HOME/k8s/argocd/install.yaml"

python3 - "$MANIFEST" <<'PY'
import sys

import yaml


path = sys.argv[1]
with open(path, "r", encoding="utf-8") as f:
    docs = list(yaml.safe_load_all(f))

targets = [
    d
    for d in docs
    if isinstance(d, dict)
    and d.get("kind") == "Deployment"
    and d.get("metadata", {}).get("name") == "argocd-repo-server"
]

assert len(targets) == 1, f"expected exactly 1 argocd-repo-server deployment, got {len(targets)}"

spec = targets[0]["spec"]["template"]["spec"]
init_containers = spec.get("initContainers") or []

names = [c.get("name") for c in init_containers]
assert "init-permissions" in names, f"missing init-permissions initContainer; initContainers={names}"
assert "copyutil" in names, f"missing copyutil initContainer; initContainers={names}"

init_perm = next(c for c in init_containers if c.get("name") == "init-permissions")
sc = init_perm.get("securityContext") or {}
assert sc.get("runAsUser") == 0, f"init-permissions must run as root (runAsUser=0), got {sc.get('runAsUser')}"

# The init-permissions script must tolerate hostPath volumes that disallow chown
# (Operation not permitted) and still make the dirs writable.
init_args = init_perm.get("args") or []
init_joined = "\n".join(init_args) if isinstance(init_args, list) else str(init_args)
assert "chown" in init_joined, "init-permissions should attempt chown when possible"
assert "chown failed" in init_joined, "init-permissions must tolerate chown failures"
assert "chmod 0777" in init_joined, "init-permissions must apply permissive chmod when chown is not allowed"

mounts = init_perm.get("volumeMounts") or []
present = {(m.get("mountPath"), m.get("name")) for m in mounts}
required = {
    ("/var/run/argocd", "var-files"),
    ("/tmp", "tmp"),
    ("/helm-working-dir", "helm-working-dir"),
    ("/home/argocd/cmp-server/plugins", "plugins"),
    ("/app/config/gpg/keys", "gpg-keyring"),
}
missing = required - present
assert not missing, f"init-permissions missing required mounts: {sorted(missing)}"

copyutil = next(c for c in init_containers if c.get("name") == "copyutil")
copy_mounts = copyutil.get("volumeMounts") or []
assert any(
    m.get("mountPath") == "/var/run/argocd" and m.get("name") == "var-files" for m in copy_mounts
), "copyutil must mount var-files at /var/run/argocd"

args = copyutil.get("args") or []
joined = " ".join(args) if isinstance(args, list) else str(args)
assert "/var/run/argocd/argocd" in joined, "copyutil must copy argocd binary into /var/run/argocd"

print("OK")
PY

echo "SUCCESS"