#!/usr/bin/env bash
set -euo pipefail

ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
cd "$ROOT"

umask 077

default_run_id="quality-$(date -u +%Y%m%dT%H%M%SZ)-$$"
run_id=${1:-$default_run_id}

if [[ ! "$run_id" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then
  echo "Run id must contain only letters, digits, dots, underscores, and hyphens." >&2
  exit 2
fi

output_root="$ROOT/output/regression"
output_dir="$output_root/$run_id"
quality_log="$output_dir/quality.log"
summary_file="$output_dir/summary.txt"

if [[ -e "$output_dir" ]]; then
  echo "Refusing to overwrite existing audit output: $output_dir" >&2
  exit 2
fi

if ! git diff --quiet ||
  ! git diff --cached --quiet ||
  [[ -n "$(git ls-files --others --exclude-standard)" ]]; then
  echo "A recorded audit must identify one exact committed source state." >&2
  echo "Commit or remove the current tracked/untracked changes, then retry." >&2
  exit 2
fi

mkdir -p "$output_root"
mkdir -m 700 "$output_dir"
install -m 600 /dev/null "$quality_log"

started_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)
git_commit=$(git rev-parse HEAD)
git_tree=$(git rev-parse 'HEAD^{tree}')
docker_server_version=$(docker version --format '{{.Server.Version}}' 2>/dev/null || printf 'unavailable')
docker_compose_version=$(docker compose version --short 2>/dev/null || printf 'unavailable')

set +e
./scripts/quality.sh 2>&1 | tee "$quality_log"
pipeline_status=("${PIPESTATUS[@]}")
set -e

quality_exit_code=${pipeline_status[0]}
tee_exit_code=${pipeline_status[1]}
finished_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)
quality_log_sha256=$(sha256sum "$quality_log" | awk '{print $1}')
test_result=$(grep -E '^Result: [0-9]+ passed' "$quality_log" | tail -n 1 || true)

status=failed
recorder_exit_code=1
if [[ "$quality_exit_code" -eq 0 &&
  "$tee_exit_code" -eq 0 ]] &&
  grep -Fqx 'All isolated quality and security gates passed.' "$quality_log"; then
  status=passed
  recorder_exit_code=0
fi

summary_tmp="$output_dir/.summary.txt.tmp"
{
  printf 'run_id=%s\n' "$run_id"
  printf 'started_at=%s\n' "$started_at"
  printf 'finished_at=%s\n' "$finished_at"
  printf 'git_commit=%s\n' "$git_commit"
  printf 'git_tree=%s\n' "$git_tree"
  printf 'git_status=clean\n'
  printf 'docker_server_version=%s\n' "$docker_server_version"
  printf 'docker_compose_version=%s\n' "$docker_compose_version"
  printf 'quality_exit_code=%s\n' "$quality_exit_code"
  printf 'tee_exit_code=%s\n' "$tee_exit_code"
  printf 'status=%s\n' "$status"
  printf 'test_result=%s\n' "$test_result"
  printf 'quality_log_sha256=%s\n' "$quality_log_sha256"
} >"$summary_tmp"
chmod 600 "$summary_tmp"
mv "$summary_tmp" "$summary_file"

printf '\nRecorded quality audit: %s\n' "$output_dir"
printf 'Status: %s\n' "$status"
printf 'Log SHA-256: %s\n' "$quality_log_sha256"

exit "$recorder_exit_code"