#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"

fail() {
  printf '%s\n' "$1" >&2
  exit 1
}

awk '
function verify() {
  if (registry && !checksum) {
    printf "registry package lacks checksum: %s\n", package > "/dev/stderr"
    failed = 1
  }
}
/^\[\[package\]\]$/ {
  verify()
  package = "unknown"
  registry = 0
  checksum = 0
  next
}
/^name = "/ {
  package = $0
  sub(/^name = "/, "", package)
  sub(/"$/, "", package)
}
/^source = "registry\+/ { registry = 1 }
/^checksum = "/ {
  value = $0
  sub(/^checksum = "/, "", value)
  sub(/"$/, "", value)
  checksum = length(value) == 64 && value !~ /[^0-9a-f]/
}
END {
  verify()
  exit failed
}
' "$ROOT/Cargo.lock"

if rg -q '^source = "git\+' "$ROOT/Cargo.lock"; then
  fail "Cargo.lock contains a Git dependency"
fi

for lock in \
  "$ROOT/contracts/typespec/package-lock.json" \
  "$ROOT/contracts/typespec-rust-emitter/package-lock.json"; do
  if ! jq -e '
    [.packages | to_entries[] |
      select(.key | startswith("node_modules/")) |
      select(.value.link != true) |
      select(.value.integrity == null)] |
    length == 0
  ' "$lock" >/dev/null; then
    fail "$lock contains a registry package without integrity"
  fi
done

read -r pnpm_packages pnpm_hashes < <(
  awk '
  BEGIN { packages = 0; hashes = 0; active = 0 }
  /^packages:/ { active = 1; next }
  /^snapshots:/ { active = 0 }
  active && /^  [^ ].*:$/ { packages++ }
  active && /integrity:/ { hashes++ }
  END { print packages, hashes }
  ' "$ROOT/web/pnpm-lock.yaml"
)
if [[ "$pnpm_packages" != "$pnpm_hashes" ]]; then
  fail "web/pnpm-lock.yaml contains a package without integrity"
fi

pnpm_ref="$(jq -r .packageManager "$ROOT/web/package.json")"
if [[ ! "$pnpm_ref" =~ ^pnpm@[0-9]+\.[0-9]+\.[0-9]+\+sha512\.[0-9a-f]{128}$ ]]; then
  fail "web/package.json packageManager is not content-pinned"
fi
if ! rg -Fq "corepack install --global $pnpm_ref" "$ROOT/Dockerfile.test"; then
  fail "Dockerfile.test does not install the pinned package manager"
fi

while IFS= read -r image; do
  if [[ ! "$image" =~ @sha256:[0-9a-f]{64}$ ]]; then
    fail "fixture image is not digest-pinned: $image"
  fi
done < <(awk -F= '/_IMAGE=/ { print $2 }' "$ROOT/tests/kind/fixture/versions.env")

while IFS= read -r image; do
  if [[ ! "$image" =~ @sha256:[0-9a-f]{64}$ ]]; then
    fail "Docker image default is not digest-pinned: $image"
  fi
done < <(awk -F= '/^ARG [A-Z_]+_IMAGE=/ { print $2 }' "$ROOT/Dockerfile" "$ROOT/Dockerfile.test")

while IFS= read -r command; do
  if [[ "$command" != *--locked* ]]; then
    fail "Cargo dependency command lacks --locked: $command"
  fi
done < <(
  {
    sed -n '/cargo \(build\|check\|clippy\|install\|nextest\|test\)/p' "$ROOT/Makefile"
    awk '
    {
      line = line $0
      if (sub(/\\$/, "", line)) {
        next
      }
      print line
      line = ""
    }
    ' "$ROOT/Dockerfile" "$ROOT/Dockerfile.test" |
      sed 's/&&/\n/g' |
      sed -n '/cargo \(build\|check\|clippy\|install\|nextest\|test\)/p'
  } | sed '/cargo fmt/d'
)

printf 'immutable external reference checks passed\n'