#!/bin/sh
set -eu

image="${1:-drive-v2:dev}"
suffix="$$"
network="drive-v2-smoke-${suffix}"
database_container="drive-v2-smoke-db-${suffix}"
application_container="drive-v2-smoke-app-${suffix}"

cleanup() {
  docker rm -f "$application_container" "$database_container" >/dev/null 2>&1 || true
  docker network rm "$network" >/dev/null 2>&1 || true
}
trap cleanup EXIT INT TERM

docker network create "$network" >/dev/null
docker run -d --name "$database_container" --network "$network" \
  -e POSTGRES_DB=drive \
  -e POSTGRES_USER=drive \
  -e POSTGRES_PASSWORD=drive-smoke-only \
  --tmpfs /var/lib/postgresql \
  postgres:18.4-bookworm >/dev/null

attempt=0
until docker exec "$database_container" pg_isready -U drive -d drive >/dev/null 2>&1; do
  attempt=$((attempt + 1))
  if [ "$attempt" -ge 30 ]; then
    docker logs "$database_container"
    exit 1
  fi
  sleep 1
done

docker run -d --name "$application_container" --network "$network" \
  --read-only --tmpfs /tmp:size=64m,mode=1777 \
  --cap-drop ALL --security-opt no-new-privileges:true \
  -e DRIVE_DATABASE_URL="postgres://drive:drive-smoke-only@${database_container}:5432/drive?sslmode=disable" \
  -p 127.0.0.1::8080 \
  "$image" >/dev/null

published="$(docker port "$application_container" 8080/tcp)"
port="${published##*:}"
attempt=0
until curl --fail --silent "http://127.0.0.1:${port}/health/ready" | grep -q '"status":"ready"'; do
  attempt=$((attempt + 1))
  if [ "$attempt" -ge 30 ]; then
    docker logs "$application_container"
    exit 1
  fi
  sleep 1
done

curl --fail --silent "http://127.0.0.1:${port}/api/v1/setup/status" \
  | grep -q '"initialized":false'
test "$(docker inspect --format '{{.Config.User}}' "$application_container")" = "65532:65532"