#!/usr/bin/env bash
# L0 policy-as-code gate (T-0.5) -- the single command CI runs. No cluster required.
#
#   Verifies:
#     1. Kyverno ClusterPolicies vs pass/fail resource fixtures  (kyverno test)
#     2. ServiceDefinition shape vs valid/invalid payloads       (kyverno-json scan)
#
# Version-pin the tools for reproducibility (docs/14, ADR-0011). Override via env.
set -euo pipefail

# --- pinned tool versions (bump via the normal update path; suite re-green is the gate) ---
KYVERNO_VERSION="${KYVERNO_VERSION:-v1.13.4}"
KYVERNO_JSON_VERSION="${KYVERNO_JSON_VERSION:-v0.0.3}"

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$HERE/.."

echo "== L0 gate: Kyverno CLI $KYVERNO_VERSION / kyverno-json $KYVERNO_JSON_VERSION =="

echo "-- [1/2] ClusterPolicy tests (kyverno test) --"
# The ClusterPolicies carry a Flux postBuild token in validationFailureAction
# (${KYVERNO_VALIDATION_ACTION}, substituted in-cluster from clusters/base/cluster-vars.yaml).
# The offline `kyverno test` CLI does not run Flux substitution, so render a throwaway copy
# with the base/prod value (Enforce) before testing — otherwise those policies fail to load
# and their result rows report "Not found". This does not change in-cluster enforcement.
: "${KYVERNO_VALIDATION_ACTION:=Enforce}"
L0_RENDER="$(mktemp -d)"
trap 'rm -rf "$L0_RENDER"' EXIT
cp -a . "$L0_RENDER/"
find "$L0_RENDER" -type f -name '*.yaml' -print0 \
  | xargs -0 sed -i "s/\${KYVERNO_VALIDATION_ACTION}/${KYVERNO_VALIDATION_ACTION}/g"
kyverno test "$L0_RENDER/tests"

echo "-- [2/2] ServiceDefinition validation (kyverno-json scan) --"
kyverno-json scan \
  --policy servicedefinition/validate-servicedefinition.yaml \
  --payload servicedefinition/payloads/valid-plex.yaml \
  --payload servicedefinition/payloads/valid-sonarr.yaml

fail=0
for f in servicedefinition/payloads/invalid-*.yaml; do
  if kyverno-json scan \
      --policy servicedefinition/validate-servicedefinition.yaml \
      --payload "$f" >/dev/null 2>&1; then
    echo "FAIL: expected $f to be REJECTED but it passed"
    fail=1
  else
    echo "ok (rejected as expected): $f"
  fi
done
[ "$fail" -eq 0 ] || { echo "L0 gate FAILED"; exit 1; }

echo "== L0 gate PASSED =="