#!/usr/bin/env bash
set -euo pipefail

root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
tmp_dir="$(mktemp -d)"
output_dir="$tmp_dir/out"

cleanup() {
  rm -rf "$tmp_dir"
}
trap cleanup EXIT

cat >"$tmp_dir/fake-dbtool" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
if [ "${1:-}" = "--version" ]; then
  echo "fake-dbtool 0.1.0"
  exit 0
fi
kind="authentication"
for arg in "$@"; do
  case "$arg" in
    59999|59998)
      kind="connection"
      ;;
    *failing_query.sql)
      kind="query"
      ;;
  esac
done
printf '{"status":"error","state":"error","error":{"kind":"%s"}}\n' "$kind"
exit 2
EOF
chmod +x "$tmp_dir/fake-dbtool"

QA_HOST_LABEL="runner-host-01" \
QA_BINARY_PATH_LABEL="./target/release/dbtool" \
QA_BINARY_VERSION="dbtool 0.1.0" \
QA_EXECUTION_PATH="host" \
QA_COMMIT_SHA="deadbeefcafebabe" \
QA_BRANCH_NAME="qa-fixture-branch" \
"$root_dir/scripts/qa/run-failure-path-evidence.sh" \
  "$tmp_dir/fake-dbtool" \
  postgres \
  "$output_dir" >/dev/null

evidence_file="$output_dir/PG-CONN-AUTH-001.md"
raw_file="$output_dir/PG-CONN-AUTH-001.out"
[ -f "$evidence_file" ] || {
  echo "expected evidence markdown not found: $evidence_file" >&2
  exit 80
}
[ -f "$raw_file" ] || {
  echo "expected raw output file not found: $raw_file" >&2
  exit 81
}

expected_lines=(
  '### PG-CONN-AUTH-001'
  '- Date (UTC): `'
  '- Operator: `qa-engineer`'
  '- Host: `runner-host-01`'
  '- Execution Path: `host`'
  '- Binary Path: `./target/release/dbtool`'
  '- Binary Version: `dbtool 0.1.0`'
  '- Commit SHA: `deadbeefcafebabe`'
  '- Branch: `qa-fixture-branch`'
  '- Driver: `postgres`'
  '- Scenario ID: `PG-CONN-AUTH-001`'
  '- Command: `./target/release/dbtool connect --driver postgres'
  '- Exit Code: `2`'
  '- Key Output: `status=error, state=error, error.kind=authentication`'
  'Output (excerpt):'
  '```'
  '{"status":"error","state":"error","error":{"kind":"authentication"}}'
  'Verdict:'
  '- Expected: non-zero exit, `status=error`, `state=error`, `error.kind=authentication`, no secret leakage'
  '- Traceability check: `complete` (none)'
  '- Secret leakage check: `not-detected` (exact)'
  '- Actual: see output excerpt above'
  '- Result: `pass`'
)

last_line=0
for expected in "${expected_lines[@]}"; do
  current_line="$(grep -nF -- "$expected" "$evidence_file" | head -n 1 | cut -d: -f1)"
  if [ -z "$current_line" ]; then
    echo "missing expected markdown line: $expected" >&2
    exit 82
  fi
  if [ "$current_line" -le "$last_line" ]; then
    echo "markdown order regression near: $expected" >&2
    exit 83
  fi
  last_line="$current_line"
done

grep -Fq '{"status":"error","state":"error","error":{"kind":"authentication"}}' "$raw_file" || {
  echo "raw output file content mismatch" >&2
  exit 84
}

echo "failure-path markdown format fixture passed"