#!/bin/bash

set -euo pipefail

source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"

status=0

verify_core_packages() {
  local package
  local -a missing=()

  while IFS= read -r package; do
    [[ -z $package || $package == \#* ]] && continue
    pacman -Q "$package" >/dev/null 2>&1 || missing+=("$package")
  done <"$OMARCHY_PATH/install/omarchy-base.packages"

  (( ${#missing[@]} == 0 )) || fail "all Omarchy core packages are installed" "missing packages: ${missing[*]}"
  pass "all Omarchy core packages are installed (${#missing[@]} missing)"
}

verify_defaults() {
  [[ $(omarchy-default-browser) == "chromium" ]] || fail "Chromium is the default browser"
  pass "Chromium is the default browser"

  [[ $(omarchy-default-terminal) == "foot" ]] || fail "Foot is the default terminal"
  pass "Foot is the default terminal"

  [[ $(omarchy-default-editor) == "nvim" ]] || fail "Neovim is the default editor"
  pass "Neovim is the default editor"

  [[ $(omarchy-theme-current) != "Unknown" ]] || fail "a current theme is configured"
  pass "a current theme is configured"

  [[ $(omarchy-theme-bg-current) != "Unknown" ]] || fail "a current background is configured"
  pass "a current background is configured"

  [[ -n $(omarchy-font-current) ]] || fail "a monospace font is configured"
  pass "a monospace font is configured"

  [[ $(xdg-mime query default x-scheme-handler/http) == "chromium.desktop" ]] || fail "HTTP MIME handling uses Chromium"
  [[ $(xdg-mime query default inode/directory) == "org.gnome.Nautilus.desktop" ]] || fail "directory MIME handling uses Nautilus"
  pass "desktop MIME handlers are configured"
}

verify_services() {
  local unit

  for unit in \
    avahi-daemon.service cups.service cups-browsed.service docker.socket \
    NetworkManager.service power-profiles-daemon.service sddm.service \
    systemd-resolved.service ufw.service; do
    systemctl is-enabled --quiet "$unit" || fail "core system services are enabled" "$unit is not enabled"
  done
  pass "core system services are enabled"

  for unit in NetworkManager.service systemd-resolved.service ufw.service; do
    systemctl is-active --quiet "$unit" || fail "critical system services are running" "$unit is not active"
  done
  pass "critical system services are running"

  systemctl --user is-active --quiet pipewire.service pipewire-pulse.service wireplumber.service ||
    fail "user audio services are running"
  pass "user audio services are running"
}

verify_printing_security() {
  local cups_browsed_pid lpinfo_output printer_name printer_process printer_tmp

  ! pacman -Q cups-pdf >/dev/null 2>&1 || fail "CUPS-PDF is absent"
  pass "the root CUPS-PDF backend is not installed"

  getent passwd cups-browsed >/dev/null || fail "the cups-browsed service account exists"
  [[ $(systemctl show -P User cups-browsed.service) == "cups-browsed" ]] ||
    fail "cups-browsed runs as its service account"
  [[ $(systemctl show -P Group cups-browsed.service) == "cups-browsed" ]] ||
    fail "cups-browsed runs as its service group"
  systemctl is-active --quiet cups-browsed.service || fail "cups-browsed is running"

  cups_browsed_pid=$(systemctl show -P MainPID cups-browsed.service)
  [[ -r /proc/$cups_browsed_pid/status ]] || fail "cups-browsed has a readable process status"
  [[ $(awk '/^Uid:/{print $2}' "/proc/$cups_browsed_pid/status") != 0 ]] ||
    fail "cups-browsed does not run with root UID"
  [[ $(awk '/^CapEff:/{print $2}' "/proc/$cups_browsed_pid/status") == "0000000000000000" ]] ||
    fail "cups-browsed has no effective Linux capabilities"

  [[ $(stat -c '%a %U:%G' /var/cache/cups-browsed) == "750 cups-browsed:cups-browsed" ]] ||
    fail "cups-browsed has an isolated cache" "$(stat -c '%a %U:%G' /var/cache/cups-browsed)"
  [[ " $(id -nG cups-browsed) " != *" cups "* ]] ||
    fail "cups-browsed is separate from the print-filter group"

  if lpinfo_output=$(LC_ALL=C timeout 10 lpinfo -v </dev/null 2>&1); then
    fail "the desktop user cannot administer CUPS without authentication"
  elif [[ $lpinfo_output != *"Forbidden"* ]]; then
    fail "CUPS explicitly denies unauthenticated desktop administration" "$lpinfo_output"
  fi

  pass "CUPS discovery is isolated from root, filters, and passwordless desktop administration"

  # A live driverless printer proves the non-root daemon can still discover and
  # create queues without the CAP_NET_BIND_SERVICE Ubuntu carries downstream.
  printer_name="OmarchyAcceptancePrinter"
  printer_tmp=$(mktemp -d)
  printf '#!/bin/bash\nexit 0\n' >"$printer_tmp/command"
  chmod 0700 "$printer_tmp/command"
  mkdir -m 0700 "$printer_tmp/spool"

  ippeveprinter -p 18631 -d "$printer_tmp/spool" -c "$printer_tmp/command" "$printer_name" \
    >"$printer_tmp/ippeveprinter.log" 2>&1 &
  printer_process=$!

  printing_test_cleanup() {
    kill "$printer_process" >/dev/null 2>&1 || true
    wait "$printer_process" >/dev/null 2>&1 || true
    rm -rf "$printer_tmp"
  }
  trap printing_test_cleanup EXIT

  for _ in {1..30}; do
    lpstat -v "$printer_name" 2>/dev/null | grep -q "implicitclass://$printer_name/" && break
    sleep 1
  done

  lpstat -v "$printer_name" 2>/dev/null | grep -q "implicitclass://$printer_name/" ||
    fail "non-root cups-browsed discovers a driverless IPP printer" "$(<"$printer_tmp/ippeveprinter.log")"

  printing_test_cleanup
  trap - EXIT

  pass "non-root cups-browsed still creates driverless IPP queues without capabilities"
}

verify_runtime_tools() {
  # Docker access is intentionally NOT granted to the desktop user: the docker
  # group is root-equivalent, so a rogue process running as the user could
  # otherwise `docker run -v /:/host` its way to passwordless root. The daemon is
  # still enabled (docker.socket, checked in verify_services) and reached through
  # a polkit/sudo prompt; opting into sudoless Docker is a separate, warned step.
  command -v docker >/dev/null 2>&1 || fail "Docker CLI is installed"
  ! id -nG | grep -qw docker || fail "desktop user must not be in the docker group"
  # The group name being absent is not sufficient — a world-writable socket or an
  # ACL would still hand the user the root daemon. Prove it is actually
  # unreachable without elevation.
  if timeout 10 docker info >/dev/null 2>&1; then
    fail "desktop user must not reach the Docker daemon without elevation"
  fi
  pass "Docker is installed but unreachable by the desktop user without elevation"

  nvim --headless '+qa' >/dev/null 2>&1 || fail "Neovim starts headlessly"
  pass "Neovim starts headlessly"

  timeout 10 fastfetch --pipe false >/dev/null 2>&1 || fail "Fastfetch can read system information"
  pass "Fastfetch can read system information"

  git --version >/dev/null || fail "Git is installed and runnable"
  tmux -V >/dev/null || fail "Tmux is installed and runnable"
  mise --version >/dev/null || fail "Mise is installed and runnable"
  pass "core terminal tools are runnable"
}

verify_user_setup() {
  local directory

  for directory in DESKTOP DOCUMENTS DOWNLOAD PICTURES; do
    [[ -d $(xdg-user-dir "$directory") ]] || fail "XDG user directories exist" "$directory is missing"
  done
  pass "XDG user directories exist"

  [[ -e $HOME/.local/state/omarchy/current/theme ]] || fail "current theme state exists"
  [[ -e $HOME/.local/state/omarchy/current/background ]] || fail "current background state exists"
  [[ -s $HOME/.config/omarchy/shell.json ]] || fail "shell configuration exists"
  jq empty "$HOME/.config/omarchy/shell.json" || fail "shell configuration is valid JSON"
  pass "Omarchy user state and shell configuration exist"
}

for check in verify_core_packages verify_defaults verify_services verify_printing_security verify_runtime_tools verify_user_setup; do
  if ! ("$check"); then
    status=1
  fi
done

exit $status