apiVersion: batch/v1
kind: Job
metadata:
  name: @@JOB_NAME@@
  namespace: nuthatch-testbed
spec:
  activeDeadlineSeconds: 300
  backoffLimit: 0
  ttlSecondsAfterFinished: 300
  template:
    spec:
      automountServiceAccountToken: false
      enableServiceLinks: false
      restartPolicy: Never
      initContainers:
        - name: credential-negative
          image: @@AWS_CLI_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              export AWS_ACCESS_KEY_ID="$NUTHATCH_S3_ACCESS_KEY"
              export AWS_SECRET_ACCESS_KEY="$NUTHATCH_S3_SECRET_KEY"
              export AWS_DEFAULT_REGION="$NUTHATCH_S3_REGION"
              printf denied-write >/tmp/denied-write

              expect_denied() {
                name="$1"
                shift
                if "$@" >/tmp/"$name".out 2>/tmp/"$name".err; then
                  exit 1
                fi
                grep -E 'AccessDenied|Forbidden|403' /tmp/"$name".err
              }

              expect_denied head \
                aws --endpoint-url "$NUTHATCH_S3_ENDPOINT" s3api head-bucket \
                --bucket nuthatch-fixture
              expect_denied list \
                aws --endpoint-url "$NUTHATCH_S3_ENDPOINT" s3api list-objects-v2 \
                --bucket nuthatch-fixture
              expect_denied get \
                aws --endpoint-url "$NUTHATCH_S3_ENDPOINT" s3api get-object \
                --bucket nuthatch-fixture --key scope-canary /tmp/denied-read
              expect_denied put \
                aws --endpoint-url "$NUTHATCH_S3_ENDPOINT" s3api put-object \
                --bucket nuthatch-fixture --key denied-write --body /tmp/denied-write
          envFrom:
            - configMapRef: {name: @@PROFILE_NAME@@}
          resources:
            requests: {cpu: 25m, memory: 64Mi}
            limits: {cpu: "1", memory: 256Mi}
      containers:
        - name: smoke
          image: @@CURL_IMAGE@@
          imagePullPolicy: Never
          command: [/bin/sh, -ec]
          args:
            - |
              base="http://nuthatch-@@LANE@@:8080"
              curl --fail --silent --show-error "$base/healthz" | grep -F '"ok":true'
              curl --fail --silent --show-error "$base/readyz" | grep -F '"ready":true'
              curl --fail --silent --show-error \
                --cookie-jar /tmp/cookies \
                --dump-header /tmp/login-headers \
                --header 'Accept: application/json' \
                --header 'Content-Type: application/json' \
                --data '{"username":"wp05-smoke"}' \
                "$base/login" >/tmp/login.json
              csrf="$(awk 'BEGIN{IGNORECASE=1} $1=="X-CSRF-Token:"{gsub("\r","",$2); print $2}' /tmp/login-headers)"
              test -n "$csrf"

              exercise_root() {
                root="$1"
                suffix="$2"
                first="first-$root"
                second="second-$root"
                printf '%s' "$first" >/tmp/body
                size="$(wc -c </tmp/body | tr -d ' ')"
                digest="$(sha256sum /tmp/body | cut -d' ' -f1)"
                curl --fail --silent --show-error \
                  --cookie /tmp/cookies \
                  --header 'Content-Type: application/octet-stream' \
                  --header "X-Declared-Size: $size" \
                  --header "X-Content-SHA256: $digest" \
                  --header "X-CSRF-Token: $csrf" \
                  --data-binary @/tmp/body \
                  "$base/upload?root=$root&path=smoke-$suffix.txt&operation_id=00000000-0000-4000-8000-0000000000${suffix}" |
                  grep -F '"result":"succeeded"'
                curl --fail --silent --show-error \
                  --cookie /tmp/cookies \
                  --header 'Accept: application/json' \
                  "$base/?root=$root" |
                  grep -F "smoke-$suffix.txt"
                curl --fail --silent --show-error \
                  --cookie /tmp/cookies \
                  "$base/download?root=$root&path=smoke-$suffix.txt" >/tmp/download
                test "$(cat /tmp/download)" = "$first"

                printf '%s' "$second" >/tmp/body
                size="$(wc -c </tmp/body | tr -d ' ')"
                digest="$(sha256sum /tmp/body | cut -d' ' -f1)"
                curl --fail --silent --show-error \
                  --cookie /tmp/cookies \
                  --header 'Content-Type: application/octet-stream' \
                  --header "X-Declared-Size: $size" \
                  --header "X-Content-SHA256: $digest" \
                  --header "X-CSRF-Token: $csrf" \
                  --data-binary @/tmp/body \
                  "$base/upload?root=$root&path=smoke-$suffix.txt&operation_id=10000000-0000-4000-8000-0000000000${suffix}" |
                  grep -F '"result":"succeeded"'
                curl --fail --silent --show-error \
                  --cookie /tmp/cookies \
                  "$base/download?root=$root&path=smoke-$suffix.txt" >/tmp/download
                test "$(cat /tmp/download)" = "$second"

                curl --fail --silent --show-error \
                  --cookie /tmp/cookies \
                  --header 'Content-Type: application/json' \
                  --data "{\"root\":\"$root\",\"path\":\"smoke-$suffix.txt\",\"operation_id\":\"20000000-0000-4000-8000-0000000000${suffix}\",\"csrf\":\"$csrf\"}" \
                  "$base/delete" |
                  grep -F '"result":"succeeded"'
                if curl --fail --silent \
                  --cookie /tmp/cookies \
                  "$base/download?root=$root&path=smoke-$suffix.txt" >/dev/null; then
                  exit 1
                fi
              }

              exercise_root personal 01
              exercise_root shared 02
              printf 'WP-05 app smoke passed\n'
          resources:
            requests: {cpu: 50m, memory: 32Mi}
            limits: {cpu: "1", memory: 128Mi}