#!/bin/sh
# The S3 delivered-contract gate: internal/objstore's
# TestDeliveredContractMinio, run against a real MinIO, with no container
# runtime anywhere in sight.
#
# THIS IS THE ONLY PLACE THIS TEST RUNS LIVE. It began as a port of the
# `minio-contract` job in .github/workflows/ci.yml, with that workflow
# holding the final say; the workflow has since been deleted (10-gate's
# header records why), so there is no longer a second run of this
# anywhere. If this step does not exercise the contract against a real
# server, nothing does — `TestDeliveredContractMinio` skips itself
# without CARLOS_MINIO_TEST, and a skipped test is a green test.
#
# References to "the workflow" below are provenance: they say where a
# choice came from and where this deliberately diverged from it. They
# describe a file that no longer exists.
#
# WHY THIS CAN EXIST HERE AT ALL
#
# .amadan/README.md used to list this job as "not ported", on the grounds
# that it starts MinIO in Docker and amadan jobs get no container
# runtime. That reasoning conflated the job with its packaging. MinIO and
# mc are single static Go binaries, published per-arch as release assets
# (see "The source" below), and contract_test.go only ever wanted MINIO_ENDPOINT
# plus credentials over HTTP — it has no opinion about what is serving.
# So the container was never load-bearing; it was just how GitHub happens
# to hand you a MinIO.
#
# Running the server as a plain process inside the job's existing
# bubblewrap sandbox was, if anything, tighter than the container the
# workflow used, and still is the tighter of the two shapes: it binds
# loopback only, its data directory is the job's private /tmp tmpfs, and
# it dies with the job's PID namespace. Nothing persists on the box.
set -eu

# Fail on a missing tool by name rather than by a confusing error forty
# lines down. Both are present on the runner; this is here so that a
# stripped-down box says which one it is missing.
for tool in curl sha256sum; do
	command -v "$tool" >/dev/null 2>&1 || {
		echo "$tool is required by this step but was not found on PATH" >&2
		exit 1
	}
done

# ---------------------------------------------------------------------
# The pins.
#
# The workflow pinned its MinIO image and its mc download, and said why:
# a floating minio tag has already broken this exact job class once, when
# mc's admin-policy syntax churned across versions. This started as a
# port of that pin, not an upgrade — RELEASE.2025-09-07T16-13-09Z is the
# same server release that image digest resolved to, and the mc release
# is the same one it downloaded.
#
# But a version string is a weaker pin than a container digest, which the
# workflow got for free and a plain URL does not: whoever serves the file
# could serve different bytes at the same path and nothing would notice.
# So each binary carries its sha256, verified after download and again on
# every cache hit, and a mismatch refuses to run rather than testing
# whatever arrived. The four digests below were taken
# from upstream's own published .sha256sum files alongside each archive
# (and independently confirmed against the downloaded bytes) on
# 2026-08-23.
#
# Bump the two releases together, and re-derive all four digests when you
# do.
#
# THE SOURCE. These used to come from dl.min.io. On 2026-09-15 every
# download URL there — this pinned archive, the "latest" build, the
# .sha256sum files, the archive listing — answers 410 Gone, with a notice
# that the open-source MinIO Server, mc and KES are archived and no longer
# served, for all community releases and hotfix builds. (The site's front
# page still loads; github.com/minio/minio and minio/mc are archived too.)
#
# The same releases are published as GitHub release assets on those
# archived repositories — attached there in April 2026, shortly before the
# archive, not there from the start. The bytes are the bytes pinned here:
# on 2026-09-15 all four were downloaded from GitHub and their sha256
# matched the four digests below exactly, as did GitHub's own .sha256sum
# files. Those digests were taken from dl.min.io in August, so the two
# sources independently agree. Only the URL moved; the pins, and what a
# mismatch does, did not.
#
# That is a stopgap and should be read as one. An archived project's
# release assets are not a promise, and there will be no further
# releases — no fixes, no security updates. The durable answers are a
# copy of these four files somewhere this deployment controls (the
# digests make any copy as trustworthy as the original), or a different
# S3-compatible server for this contract, which is a larger decision: the
# test exists to prove IAM-policy behaviour against a real server.
MINIO_RELEASE=RELEASE.2025-09-07T16-13-09Z
MC_RELEASE=RELEASE.2025-08-13T08-35-41Z

# Arch-aware on purpose. The amadan runner is arm64; the workflow's
# ubuntu-latest was amd64, and it hardwired linux-amd64 for its mc
# download — harmless there, wrong here, and a bug not to carry across.
# The runner fleet is also the kind of thing that changes under you, so
# this reads uname rather than trusting a note about what the box is.
case "$(uname -m)" in
x86_64 | amd64)
	arch=amd64
	minio_sha=7c5bd8512c6e966455b1d198209358b2d191c77a83ab377c4073281065fb855f
	mc_sha=01f866e9c5f9b87c2b09116fa5d7c06695b106242d829a8bb32990c00312e891
	;;
aarch64 | arm64)
	arch=arm64
	minio_sha=5c83cd2cf151717ba0243f73e1c7802ff36e272b67144bdd7f1f7d684fd6f03d
	mc_sha=14c8c9616cfce4636add161304353244e8de383b2e2752c0e9dad01d4c27c12c
	;;
*)
	echo "no pinned MinIO build for $(uname -m) — add one above, do not guess" >&2
	exit 1
	;;
esac

echo "minio contract: $arch, minio $MINIO_RELEASE, mc $MC_RELEASE"

# ---------------------------------------------------------------------
# The cache.
#
# amadan reuses one workspace per repo across jobs and does not clean
# untracked files between them by default, so an untracked directory in
# the checkout IS the cache — no separate cache action, no key, nothing
# to expire. ~140MB of binaries then downloads once per worker rather
# than once per run.
#
# The dot prefix is deliberate: the Go toolchain skips dot-directories
# when walking ./..., so this cannot leak into `go build ./...` or
# `go vet ./...` in 10-gate no matter what ends up inside it. The digest
# check below is what makes reusing the cache safe — a truncated or
# half-written binary from an interrupted job fails verification and is
# re-fetched, so a cache hit is never taken on trust.
cache="$PWD/.amadan-cache/minio-$arch"
mkdir -p "$cache"

fetch_pinned() {
	fp_name=$1
	fp_url=$2
	fp_want=$3
	fp_dest=$4

	if [ -f "$fp_dest" ] && [ "$(sha256sum <"$fp_dest" | cut -d' ' -f1)" = "$fp_want" ]; then
		echo "  $fp_name: cached, digest verified"
		return 0
	fi

	echo "  $fp_name: downloading $fp_url"
	curl -sfL --retry 3 -o "$fp_dest.part" "$fp_url"

	fp_got=$(sha256sum <"$fp_dest.part" | cut -d' ' -f1)
	if [ "$fp_got" != "$fp_want" ]; then
		rm -f "$fp_dest.part"
		echo "$fp_name digest mismatch — refusing to run" >&2
		echo "  want $fp_want" >&2
		echo "  got  $fp_got" >&2
		echo "  from $fp_url" >&2
		exit 1
	fi

	chmod +x "$fp_dest.part"
	mv "$fp_dest.part" "$fp_dest"
	echo "  $fp_name: downloaded, digest verified"
}

fetch_pinned minio \
	"https://github.com/minio/minio/releases/download/$MINIO_RELEASE/minio.linux-$arch.$MINIO_RELEASE" \
	"$minio_sha" "$cache/minio"
fetch_pinned mc \
	"https://github.com/minio/mc/releases/download/$MC_RELEASE/mc.linux-$arch.$MC_RELEASE" \
	"$mc_sha" "$cache/mc"

minio=$cache/minio
mc=$cache/mc

# ---------------------------------------------------------------------
# Scratch state, and getting rid of it.
#
# Everything mutable this step creates lives under one directory: MinIO's
# data, mc's config (MC_CONFIG_DIR, so mc never touches $HOME), the
# policy document, and the server log. /tmp inside an amadan job is a
# private tmpfs that the sandbox discards when the job ends, so this is
# scratch in the strongest sense available.
rundir=$(mktemp -d "${TMPDIR:-/tmp}/carlos-minio-contract-XXXXXX")
MC_CONFIG_DIR=$rundir/mc
export MC_CONFIG_DIR

minio_pid=

# The trap runs on the success path and on every failure path, because
# `set -eu` exits through it — which is the point. A step that leaves a
# MinIO listening on a shared box after it fails would poison every later
# run on that worker, and the failure that caused it is exactly when
# nobody is watching.
cleanup() {
	if [ -n "$minio_pid" ]; then
		kill "$minio_pid" 2>/dev/null || true
		wait "$minio_pid" 2>/dev/null || true
	fi
	rm -rf "$rundir"
}
trap cleanup EXIT INT TERM

# Root credentials are minted per run rather than hardcoded. They are not
# a secret — the server is loopback-only and lives for seconds — but
# random ones make the identity check below meaningful: creds that only
# this process knows cannot authenticate against somebody else's MinIO.
root_user=root$$
root_pass=$(head -c 18 /dev/urandom | od -An -tx1 | tr -d ' \n')

# ---------------------------------------------------------------------
# Start the server.
#
# The workflow used a fixed port 9000 because its MinIO was in a
# container with its own network. amadan jobs deliberately do NOT get
# --unshare-net (they need the Go module proxy), so a job shares the
# host's network
# namespace with the worker and with anything else on it. 9000 is a
# popular port; assuming it is free is assuming something this step does
# not know.
#
# So: pick a high port, and if MinIO cannot take it, pick another. The
# liveness probe alone would not be enough to tell the two cases apart —
# a foreign MinIO already on the port answers /health/live perfectly
# happily, and we would then test somebody else's server. Requiring OUR
# process to still be alive is what distinguishes "it started" from "the
# port was taken"; `mc alias set` with the random root credentials above
# is the second, independent check that the thing answering is ours.
port=
attempt=1
while [ "$attempt" -le 5 ]; do
	candidate=$((20000 + ($$ + attempt * 997) % 20000))
	rm -rf "$rundir/data"
	mkdir -p "$rundir/data"

	MINIO_ROOT_USER=$root_user MINIO_ROOT_PASSWORD=$root_pass \
		"$minio" server "$rundir/data" \
		--address "127.0.0.1:$candidate" \
		--console-address "127.0.0.1:0" \
		>"$rundir/minio.log" 2>&1 &
	minio_pid=$!

	waited=0
	while [ "$waited" -lt 30 ]; do
		if ! kill -0 "$minio_pid" 2>/dev/null; then
			break # died — almost certainly could not bind
		fi
		if curl -sf "http://127.0.0.1:$candidate/minio/health/live" >/dev/null; then
			port=$candidate
			break
		fi
		sleep 1
		waited=$((waited + 1))
	done

	[ -n "$port" ] && break

	kill "$minio_pid" 2>/dev/null || true
	wait "$minio_pid" 2>/dev/null || true
	minio_pid=
	echo "  minio did not come up on 127.0.0.1:$candidate, trying another port"
	attempt=$((attempt + 1))
done

if [ -z "$port" ]; then
	echo "minio never became healthy after 5 attempts; last log:" >&2
	cat "$rundir/minio.log" >&2
	exit 1
fi

echo "  minio healthy on 127.0.0.1:$port"

# ---------------------------------------------------------------------
# The fixture: two buckets and a scoped user granted exactly one of them.
#
# Carried over from the workflow's `mint scoped user` step — same bucket
# names, same user — because the whole value of the test is that
# cross-bucket denial is enforced by real IAM rather than by the client
# politely not asking. Nothing checks this policy against a second copy,
# so loosening it here is invisible: grant `denied-bucket` by accident
# and the test still passes while proving nothing. Change it only on
# purpose.
#
# THIS DOCUMENT MUST TRACK storePolicyJSON (internal/objstore/aws.go).
# It is a hand-written copy of what the console writes for a real store,
# and the test now asserts security properties OF THE POLICY — not just
# that an S3 client works. The two Deny statements are the anti-forgery
# pair, and the second one is the load-bearing one: leaving
# s3:PutObjectTagging out of the Allow does NOT stop an app tagging its
# own object, because x-amz-tagging on PutObject sets tags without ever
# naming that action. MinIO let the tagged upload through until the
# s3:RequestObjectTagKeys Deny was added. Drop either statement here and
# the test goes red, which is the point: this file is where the property
# is checked against a real server rather than argued about.
"$mc" --quiet alias set local "http://127.0.0.1:$port" "$root_user" "$root_pass"
"$mc" --quiet mb local/contract-bucket local/denied-bucket

cat >"$rundir/policy.json" <<'EOF'
{"Version": "2012-10-17", "Statement": [
  {"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::contract-bucket"]},
  {"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetObjectTagging"], "Resource": ["arn:aws:s3:::contract-bucket/*"]},
  {"Effect": "Deny", "Action": ["s3:PutObjectTagging", "s3:DeleteObjectTagging", "s3:PutObjectVersionTagging", "s3:DeleteObjectVersionTagging"], "Resource": ["arn:aws:s3:::contract-bucket/*"]},
  {"Effect": "Deny", "Action": ["s3:PutObject"], "Resource": ["arn:aws:s3:::contract-bucket/*"],
   "Condition": {"ForAnyValue:StringEquals": {"s3:RequestObjectTagKeys": ["carlos-scan", "carlos-scan-version", "carlos-scan-at"]}}}
]}
EOF

"$mc" --quiet admin policy create local contract-only "$rundir/policy.json"
"$mc" --quiet admin user add local scopeduser scopedsecret1
"$mc" --quiet admin policy attach local contract-only --user scopeduser

echo "  buckets and scoped user ready"

# ---------------------------------------------------------------------
# Run it.
#
# Same env var names the test reads (contract_test.go's requireEnv calls),
# and -count=1 for the same reason 10-gate uses it: never satisfy a gate
# from a cached pass. Output goes to a file rather than through a pipe
# because POSIX sh has no pipefail, and this step needs the test's own
# exit status, not tee's.
out=$rundir/test.log
set +e
CARLOS_MINIO_TEST=1 \
	MINIO_ENDPOINT="http://127.0.0.1:$port" \
	MINIO_SCOPED_KEY=scopeduser \
	MINIO_SCOPED_SECRET=scopedsecret1 \
	MINIO_BUCKET=contract-bucket \
	MINIO_DENIED_BUCKET=denied-bucket \
	go test ./internal/objstore/ -run TestDeliveredContractMinio -count=1 -v >"$out" 2>&1
test_status=$?
set -e

cat "$out"

if [ "$test_status" -ne 0 ]; then
	exit "$test_status"
fi

# THE ASSERTION. Do not delete this because the test above already
# "passed".
#
# TestDeliveredContractMinio skips itself unless CARLOS_MINIO_TEST=1, and
# a skipped Go test exits 0. So every interesting way this step can break
# — a typo'd env var, a MinIO that started but was never reachable, a
# rename of the test, a future edit that drops the env block — produces a
# green step that tested nothing at all. That is strictly worse than no
# step, because it reports coverage this repo does not have.
#
# Requiring the parent test's PASS line to actually appear closes it. The
# trailing " (" anchors on the parent rather than its subtests, whose
# PASS lines are indented anyway.
if ! grep -q '^--- PASS: TestDeliveredContractMinio (' "$out"; then
	echo >&2
	echo "the contract test did not PASS — it was skipped, filtered out, or renamed." >&2
	echo "go test exited 0, which for this test means nothing was exercised: it" >&2
	echo "skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2
	echo "TestDeliveredContractMinio still exists in internal/objstore." >&2
	exit 1
fi

# T4's store probe (moves spec §7.3, §14.1): the same server, the same
# scoped user and bucket, and the same rule that its PASS line must appear,
# because TestT4StorageProbeMinio skips itself without CARLOS_MINIO_TEST too.
out2=$rundir/test-t4.log
set +e
CARLOS_MINIO_TEST=1 \
	MINIO_ENDPOINT="http://127.0.0.1:$port" \
	MINIO_SCOPED_KEY=scopeduser \
	MINIO_SCOPED_SECRET=scopedsecret1 \
	MINIO_BUCKET=contract-bucket \
	MINIO_DENIED_BUCKET=denied-bucket \
	go test ./internal/host/ -run TestT4StorageProbeMinio -count=1 -v >"$out2" 2>&1
test_status=$?
set -e

cat "$out2"

if [ "$test_status" -ne 0 ]; then
	exit "$test_status"
fi

if ! grep -q '^--- PASS: TestT4StorageProbeMinio (' "$out2"; then
	echo >&2
	echo "the T4 probe test did not PASS: it was skipped, filtered out, or renamed." >&2
	echo "It skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2
	echo "TestT4StorageProbeMinio still exists in internal/host." >&2
	exit 1
fi

# The change index (S3 change-index design §3, §6): release.S3Store against
# the same server. A 304 on a current ETag, an ETag listing that agrees with
# Get, and the index bump through every mutation path are the server's
# behaviour; no fake client shows them. Same rule again: the test skips
# without CARLOS_MINIO_TEST, so its PASS line has to appear.
out3=$rundir/test-s3store.log
set +e
CARLOS_MINIO_TEST=1 \
	MINIO_ENDPOINT="http://127.0.0.1:$port" \
	MINIO_SCOPED_KEY=scopeduser \
	MINIO_SCOPED_SECRET=scopedsecret1 \
	MINIO_BUCKET=contract-bucket \
	go test ./internal/release/ -run TestS3StoreMinioContract -count=1 -v >"$out3" 2>&1
test_status=$?
set -e

cat "$out3"

if [ "$test_status" -ne 0 ]; then
	exit "$test_status"
fi

if ! grep -q '^--- PASS: TestS3StoreMinioContract (' "$out3"; then
	echo >&2
	echo "the S3Store contract test did not PASS: it was skipped, filtered out, or renamed." >&2
	echo "It skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2
	echo "TestS3StoreMinioContract still exists in internal/release." >&2
	exit 1
fi

# The forwarded db read (db region forward plan 2: T1 and T16): one
# deployment bucket, versioned, and a data bucket per region, on the one
# server. The console user cannot read uk's data bucket; the uk box user
# can. Neither may delete: the protocol deletes nothing (J4), so a delete
# would fail at the server as well as in the tests' store wrappers.
"$mc" --quiet mb local/dbf-deploy local/dbf-data-ie local/dbf-data-uk
"$mc" --quiet version enable local/dbf-deploy
cat >"$rundir/dbf-console.json" <<'EOF'
{"Version": "2012-10-17", "Statement": [
  {"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::dbf-deploy", "arn:aws:s3:::dbf-data-ie"]},
  {"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": ["arn:aws:s3:::dbf-deploy/*"]},
  {"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::dbf-data-ie/*"]}
]}
EOF
cat >"$rundir/dbf-ukbox.json" <<'EOF'
{"Version": "2012-10-17", "Statement": [
  {"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::dbf-deploy", "arn:aws:s3:::dbf-data-uk"]},
  {"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": ["arn:aws:s3:::dbf-deploy/*"]},
  {"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::dbf-data-uk/*"]}
]}
EOF
"$mc" --quiet admin policy create local dbf-console "$rundir/dbf-console.json"
"$mc" --quiet admin policy create local dbf-ukbox "$rundir/dbf-ukbox.json"
"$mc" --quiet admin user add local dbfconsole dbfconsolesecret1
"$mc" --quiet admin user add local dbfukbox dbfukboxsecret1
"$mc" --quiet admin policy attach local dbf-console --user dbfconsole
"$mc" --quiet admin policy attach local dbf-ukbox --user dbfukbox

out4=$rundir/test-dbf.log
set +e
CARLOS_MINIO_TEST=1 \
	MINIO_ENDPOINT="http://127.0.0.1:$port" \
	DBF_ROOT_KEY="$root_user" DBF_ROOT_SECRET="$root_pass" \
	DBF_CONSOLE_KEY=dbfconsole DBF_CONSOLE_SECRET=dbfconsolesecret1 \
	DBF_BOX_KEY=dbfukbox DBF_BOX_SECRET=dbfukboxsecret1 \
	go test ./internal/console/ -run 'TestDBForwardMinio' -count=1 -v >"$out4" 2>&1
test_status=$?
set -e
cat "$out4"
if [ "$test_status" -ne 0 ]; then
	exit "$test_status"
fi
if ! grep -q '^--- PASS: TestDBForwardMinio (' "$out4"; then
	echo >&2
	echo "the forwarded db read test did not PASS: it was skipped, filtered out, or renamed." >&2
	echo "It skips unless CARLOS_MINIO_TEST=1. Check the env block above and that" >&2
	echo "TestDBForwardMinio still exists in internal/console." >&2
	exit 1
fi

echo "minio contract: PASS"