#!/usr/bin/env bash
# test-greeter-qemu.sh — bounded QEMU proof for the Red Bear greeter/auth surface.

set -euo pipefail

usage() {
    cat <<'USAGE'
Usage: test-greeter-qemu.sh [--check]

Boot redbear-full in QEMU, log in on the fallback console, and verify the greeter daemon/socket
surface, invalid-login handling, and a bounded successful-login return-to-greeter proof.
USAGE
}

check_mode=0
for arg in "$@"; do
    case "$arg" in
        --help|-h|help)
            usage
            exit 0
            ;;
        --check)
            check_mode=1
            ;;
        *)
            echo "ERROR: unsupported argument $arg" >&2
            usage >&2
            exit 1
            ;;
    esac
done

firmware=""
for candidate in \
    /usr/share/ovmf/x64/OVMF.4m.fd \
    /usr/share/OVMF/x64/OVMF.4m.fd \
    /usr/share/ovmf/OVMF.fd \
    /usr/share/OVMF/OVMF_CODE.fd \
    /usr/share/qemu/edk2-x86_64-code.fd
do
    if [[ -f "$candidate" ]]; then
        firmware="$candidate"
        break
    fi
done

if [[ -z "$firmware" ]]; then
    echo "ERROR: no usable x86_64 UEFI firmware found" >&2
    exit 1
fi

arch="${ARCH:-$(uname -m)}"
iso="build/$arch/redbear-full.iso"
image="build/$arch/redbear-full/harddrive.img"

boot_media=""
if [[ -f "$iso" ]]; then
    boot_media="iso"
elif [[ -f "$image" ]]; then
    boot_media="harddrive"
else
    echo "ERROR: no bootable image found ($iso or $image)" >&2
    echo "Build it first with: ./local/scripts/build-redbear.sh redbear-full" >&2
    exit 1
fi

if [[ "$boot_media" == "iso" ]]; then
    boot_args=(-cdrom "$iso")
else
    boot_args=(-drive file="$image",format=raw,if=none,id=drv0 -device nvme,drive=drv0,serial=NVME_SERIAL)
fi

if [[ "$check_mode" -eq 0 ]]; then
    exec qemu-system-x86_64 \
        -name "Red Bear Greeter Validation" \
        -device qemu-xhci \
        -smp 4 \
        -m 2048 \
        -bios "$firmware" \
        -chardev stdio,id=debug,signal=off,mux=on \
        -serial chardev:debug \
        -mon chardev:debug \
        -machine q35 \
        -device ich9-intel-hda -device hda-output \
        -device virtio-net,netdev=net0 \
        -netdev user,id=net0 \
        -vga none \
        -device virtio-gpu \
        "${boot_args[@]}" \
        -enable-kvm -cpu host
fi

pkill -f "qemu-system-x86_64.*redbear-full" 2>/dev/null || true
sleep 1

attempt=1
while true; do
    rc=0
    python3 local/scripts/qemu-login-expect.py \
    --timeout 240 \
    --log "build/$arch/redbear-full/greeter-check.log" \
    --step "expect:login:" \
    --step "send:root" \
    --step "expect:assword:" \
    --step "send:password" \
    --step "expect:Type 'help' for available commands." \
    --step "send:redbear-greeter-check" \
    --step "expect:Red Bear Greeter Runtime Check" \
    --step "expect:GREETER_HELLO=ok" \
    --step "send:redbear-greeter-check --invalid root wrong" \
    --step "expect:GREETER_INVALID=ok" \
    --step "send:redbear-greeter-check --valid root password" \
    --step "expect:GREETER_VALID=ok" \
    --step "send:shutdown" \
    --pass_marker "GREETER_VALID=ok" \
    -- \
    qemu-system-x86_64 -name "Red Bear Greeter Validation" -device qemu-xhci -smp 4 -m 2048 -bios "$firmware" -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev:debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -vga none -device virtio-gpu "${boot_args[@]}" -enable-kvm -cpu host || rc=$?
    if [[ $rc -eq 0 ]]; then
        break
    fi
    if [[ ( $rc -eq 3 || $rc -eq 137 ) && $attempt -lt 5 ]]; then
        attempt=$((attempt + 1))
        echo "QEMU exited before completing the check; retrying (attempt $attempt/5)"
        sleep 2
        continue
    fi
    exit "$rc"
done
pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
echo "Greeter runtime validation completed via guest runtime check"