#!/usr/bin/env nu
# Verify SSH streams, host trust, host denial, and standard WASI imports.
use std/assert
def wasi [component: path, root: path, args: list, input: string = ''] {
    let ready = (open ($root | path join ready.json))
    $input | ^wasmtime run -S inherit-network -S allow-ip-name-lookup -S http -S cli-exit-with-code=y --dir $'($root)/guest::/' --env HOME=/home --env $'SAUSAGE_HOST_API=http://127.0.0.1:($ready.api)' $component ...$args | complete
}
def main [component: path, root: path] {
    let component = ($component | path expand)
    let root = ($root | path expand)
    let wit = (^wasm-tools component wit $component | complete)
    assert equal $wit.exit_code 0
    let imports = ($wit.stdout | lines | str trim | where {|line| $line | str starts-with 'import '})
    assert (not ($imports | is-empty))
    assert ($imports | all {|line| $line | str starts-with 'import wasi:'})
    print 'SSH component imports: PASS (WASI only)'
    print ($imports | str join (char newline))
    let ready = (open ($root | path join ready.json))
    let destination = $'($ready.user)@127.0.0.1'
    let args = [-p $ready.ssh $destination 'echo hi; exit 3']
    let unknown = (wasi $component $root $args)
    assert equal $unknown.exit_code 255
    assert ($unknown.stderr | str contains 'Host key verification failed')
    print 'Unknown host key: PASS'
    let accepted = (wasi $component $root ([-o StrictHostKeyChecking=accept-new] | append $args))
    assert equal $accepted.exit_code 3
    assert equal $accepted.stdout $"hi\n"
    assert (($root | path join guest/home/.ssh/known_hosts) | path exists)
    print 'Accept-new records the host key, prints hi, and exits 3: PASS'
    let repeated = (wasi $component $root $args)
    assert equal $repeated.exit_code 3
    assert equal $repeated.stdout $"hi\n"
    print 'Known host key: PASS'
    let streams = (wasi $component $root [-p $ready.ssh -l $ready.user 127.0.0.1 'cat; echo error >&2; exit 7'] $"input\n")
    assert equal $streams.exit_code 7
    assert equal $streams.stdout $"input\n"
    assert equal $streams.stderr $"error\n"
    print 'Stdin, stdout, stderr, -l user, and remote exit 7: PASS'
    let default_user = (wasi $component $root [-p $ready.ssh 127.0.0.1 'echo default'])
    assert equal $default_user.exit_code 0
    assert equal $default_user.stdout $"default\n"
    print 'Default user from host identity: PASS'
    'deny' | save ($root | path join host/deny)
    let denied = (wasi $component $root $args)
    assert equal $denied.exit_code 255
    assert ($denied.stderr | str contains 'test-key')
    assert ($denied.stderr | str contains 'test-request')
    print 'Host API 403 names the item and request, and exits 255: PASS'
    rm ($root | path join host/deny)
    http post --content-type application/json $'http://127.0.0.1:($ready.api)/fixture/rotate' '{}' | ignore
    let changed = (wasi $component $root ([-o StrictHostKeyChecking=accept-new] | append $args))
    assert equal $changed.exit_code 255
    assert ($changed.stderr | str contains 'REMOTE HOST IDENTIFICATION HAS CHANGED')
    print 'Changed host key fails even with accept-new: PASS'
    print $'Fixture: ($root)'
}