#!/usr/bin/env bash
# shellcheck disable=SC2016
# Fresh setup is driven by ordinary Git enrollment, not implicit config capture.
require_cmd git
require_cmd jq
export MISE_HISTORY_NOTIFY=false
origin="$PWD/setup.git"
git init -q --bare -b main "$origin"
echo native >~/.native
chmod 600 ~/.native
assert_succeed "mise bootstrap dotfiles track ~/.native"
assert_succeed "mise bootstrap dotfiles origin set file://$origin --sync manual --yes"
initial=$(git --git-dir="$origin" rev-parse main)
second="$(dirname "$HOME")/fresh-machine"
mkdir -p "$second"
b() {
  (
    cd "$second" || exit
    env HOME="$second" XDG_CONFIG_HOME="$second/.config" MISE_CONFIG_DIR="$second/.config/mise" \
      MISE_STATE_DIR="$second/.local/state/mise" MISE_DATA_DIR="$second/.local/share/mise" \
      MISE_CACHE_DIR="$second/.cache/mise" MISE_TRUSTED_CONFIG_PATHS="$second" mise "$@"
  )
}
export second
export -f b
# Earlier non-tracking bootstrap work must not create unrelated file history.
assert_succeed "b bootstrap --yes"
assert_fail "git --git-dir=$second/.local/state/mise/history/repo.git rev-parse --verify HEAD"
assert_succeed "b bootstrap --from-git file://$origin --yes"
assert "cat $second/.native" "native"
assert "(b doctor --json 2>/dev/null || true) | jq -r .dotfiles.tracked" "1"
if [[ "$(uname)" == Darwin ]]; then
  mode_of="stat -f %Lp"
else
  mode_of="stat -c %a"
fi
assert "$mode_of $second/.native" "600"
repository="$second/.local/state/mise/history/repo.git"
assert_succeed "git --git-dir=$repository merge-base --is-ancestor $initial main"

assert_fail "test -e $second/.git"
assert_fail "test -e $second/.config/mise/.git"
assert_fail "test -e $second/.config/mise/config.toml"
echo edited >"$second/.native"
assert_succeed "b bootstrap dotfiles save"
assert "git --git-dir=$repository show main:home/.native" "edited"
assert_succeed "b bootstrap dotfiles sync"
assert "git --git-dir=$origin show main:home/.native" "edited"

# An identical existing file is not a conflict on first adoption.
second="$(dirname "$HOME")/identical-machine"
mkdir -p "$second"
echo edited >"$second/.native"
assert_succeed "b bootstrap --from-git file://$origin --yes"
assert "cat $second/.native" "edited"

# A differing existing file pauses adoption without inventing local ancestry.
second="$(dirname "$HOME")/conflicted-machine"
mkdir -p "$second"
echo keep-me >"$second/.native"
assert_fail "b bootstrap --from-git file://$origin --yes" "paused"
assert "cat $second/.native" "keep-me"
repository="$second/.local/state/mise/history/repo.git"
assert_fail "git --git-dir=$repository rev-parse --verify main"
assert_succeed "b bootstrap dotfiles pull --take-remote $second/.native --yes"
assert "cat $second/.native" "edited"
assert_succeed "git --git-dir=$repository merge-base --is-ancestor $initial main"

# Encrypted enrollment and public recipients arrive in the same Git history.
encrypted_origin="$PWD/encrypted-setup.git"
git init -q --bare -b main "$encrypted_origin"
export MISE_AGE_KEY="AGE-SECRET-KEY-142E7VJ8GUWR94MXDCYQJ7ZTQZRXKQSP9PUJU8HUQJ206QN7QPV4SM5QRL8"
cat >"$MISE_CONFIG_DIR/config.toml" <<'TOML'
[history.encryption]
recipients = ["age1fuvsfq02qr5ju0nhh3rulrwracymjljlr5j49kres24ltd3fjq0s9z9d8l"]
[dotfiles]
"~/.encrypted-value" = { mode = "track", encrypt = true }
TOML
echo confidential >~/.encrypted-value
plaintext=$(git hash-object ~/.encrypted-value)
assert_succeed "mise bootstrap dotfiles save"
assert_succeed "mise bootstrap dotfiles origin set file://$encrypted_origin --sync manual --yes"
second="$(dirname "$HOME")/encrypted-machine"
mkdir -p "$second"
assert_succeed "b bootstrap --from-git file://$encrypted_origin --yes"
assert "cat $second/.encrypted-value" "confidential"
repository="$second/.local/state/mise/history/repo.git"
assert_fail "git --git-dir=$repository cat-file -e $plaintext"
echo changed-confidential >"$second/.encrypted-value"
changed_plaintext=$(git hash-object "$second/.encrypted-value")
assert_succeed "b bootstrap dotfiles save"
assert_fail "git --git-dir=$repository cat-file -e $changed_plaintext"
assert_succeed "b bootstrap dotfiles sync"
assert_fail "git --git-dir=$encrypted_origin cat-file -e $changed_plaintext"
