#!/usr/bin/env bash
# remediation-marker-match.test.sh — the anchored, trusted FORGE:REMEDIATION trail match (forge#3412)
# Exercises the exact regexes used by commands/work-on/remediate.md Phase M0, commands/work-on.md Phase 0B
# and commands/orchestrate/phase-4-execution.md. No network. Usage: bash scripts/remediation-marker-match.test.sh
# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
# SPDX-License-Identifier: AGPL-3.0-or-later

set -uo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
TC="$SCRIPT_DIR/trusted-comments.sh"
unset FORGE_TRAIL_TRUSTED_ASSOCIATIONS FORGE_TRAIL_TRUSTED_LOGINS

PASS=0; FAILN=0
ok()  { PASS=$((PASS+1)); echo "ok   - $1"; }
bad() { FAILN=$((FAILN+1)); echo "FAIL - $1"; }
eq()  { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1 (got '$2', want '$3')"; fi; }

COMPLETE_RE='^<!-- FORGE:REMEDIATION -->[\s\S]*<!-- FORGE:REMEDIATION:COMPLETE -->'
TRAIL_RE='^<!-- FORGE:REMEDIATION -->'
# c <assoc> <type> <login> <body>
c() { jq -nc --arg a "$1" --arg t "$2" --arg l "$3" --arg b "$4" '{id:1,author_association:$a,user:{type:$t,login:$l},body:$b}'; }
complete_n() { printf '%s' "$1" | bash "$TC" count "$COMPLETE_RE"; }
trail_n()    { printf '%s' "$1" | bash "$TC" count "$TRAIL_RE"; }

REAL=$'<!-- FORGE:REMEDIATION -->\n## Remediation\nVerdict: FIXED\n\n<!-- FORGE:REMEDIATION:COMPLETE -->'
INTERIM=$'<!-- FORGE:REMEDIATION -->\n## Remediation (in progress)'
QUOTED_REVIEW=$'## Review\nThe prior run posted FORGE:REMEDIATION:COMPLETE on this PR.\n<!-- FORGE:REMEDIATION:COMPLETE -->'
QUOTED_WORK_ORDER=$'<!-- FORGE:INPR_FIX: head=abc1234 -->\nquoting <!-- FORGE:REMEDIATION -->\n<!-- FORGE:REMEDIATION:COMPLETE -->'

eq "genuine M8 trail by bot matches COMPLETE" "$(complete_n "[$(c NONE Bot 'app[bot]' "$REAL")]")" 1
eq "review comment quoting COMPLETE mid-body does not match" "$(complete_n "[$(c OWNER User u "$QUOTED_REVIEW")]")" 0
eq "INPR_FIX work order quoting the markers does not match COMPLETE" "$(complete_n "[$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 0
eq "INPR_FIX work order quoting the markers is not a trail comment" "$(trail_n "[$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 0
eq "quoting comment posted AFTER the real trail does not hide it" "$(complete_n "[$(c NONE Bot b "$REAL"),$(c NONE Bot b "$QUOTED_WORK_ORDER")]")" 1
eq "untrusted-author trail does not match" "$(complete_n "[$(c NONE User mallory "$REAL")]")" 0
eq "trusted human (MEMBER) trail matches" "$(complete_n "[$(c MEMBER User dev "$REAL")]")" 1
eq "interim trail (no COMPLETE) is a trail but not complete" "$(complete_n "[$(c NONE Bot b "$INTERIM")]")/$(trail_n "[$(c NONE Bot b "$INTERIM")]")" "0/1"
eq "paginated concatenated arrays" "$(complete_n "[$(c NONE Bot b "$QUOTED_REVIEW")] [$(c NONE Bot b "$REAL")]")" 1
printf 'not json' | bash "$TC" count "$COMPLETE_RE" >/dev/null 2>&1; eq "unparsable comments fail closed (exit 2)" "$?" 2

# Spec wiring: no unanchored marker read remains, and each reader goes through the trust helper.
! grep -qF 'contains("FORGE:REMEDIATION")' "$ROOT/commands/work-on/remediate.md" && ok "remediate.md has no unanchored contains(FORGE:REMEDIATION)" || bad "remediate.md still uses unanchored contains"
! grep -qF 'contains("FORGE:REMEDIATION")' "$ROOT/commands/orchestrate/phase-4-execution.md" && ok "phase-4-execution.md has no unanchored contains(FORGE:REMEDIATION)" || bad "phase-4-execution.md still uses unanchored contains"
for f in commands/work-on/remediate.md commands/work-on.md commands/orchestrate/phase-4-execution.md; do
  grep -qF 'trusted-comments.sh' "$ROOT/$f" && ok "$f references trusted-comments.sh" || bad "$f does not reference trusted-comments.sh"
done
grep -qF "count '$COMPLETE_RE'" "$ROOT/commands/work-on/remediate.md" && ok "remediate.md uses the tested COMPLETE regex" || bad "remediate.md COMPLETE regex drifted from this test"

echo "passed=$PASS failed=$FAILN"
[ "$FAILN" -eq 0 ]