#!/usr/bin/env bash
set -euo pipefail
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
fixture=$(mktemp -d)
server_pid=
cleanup() {
if test -n "$server_pid"; then
kill "$server_pid" 2>/dev/null || true
wait "$server_pid" 2>/dev/null || true
fi
rm -rf "$fixture"
}
trap cleanup EXIT
mkdir -p "$fixture/web/assets"
printf '\n' > "$fixture/web/index.html"
printf 'window.__LINGNIU_APP_CONFIG__={"amapSecurityServiceHost":"/_AMapService"};\n' > "$fixture/web/app-config.js"
printf 'console.log("new");\n' > "$fixture/web/assets/new.js"
printf 'console.log("old");\n' > "$fixture/web/assets/old.js"
printf 'new.js\n' > "$fixture/web/.release-assets"
printf 'old.js\n' > "$fixture/previous-assets"
cp -R "$fixture/web" "$fixture/served"
port=$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1]); s.close()')
(cd "$fixture/served" && exec python3 -m http.server "$port" --bind 127.0.0.1) > "$fixture/server.log" 2>&1 &
server_pid=$!
server_ready=false
for _ in $(seq 1 30); do
if curl --silent --fail "http://127.0.0.1:$port/" >/dev/null 2>&1; then
server_ready=true
break
fi
if ! kill -0 "$server_pid" 2>/dev/null; then
cat "$fixture/server.log" >&2
printf 'fixture HTTP server exited before becoming ready\n' >&2
exit 1
fi
sleep 0.1
done
if test "$server_ready" != true; then
cat "$fixture/server.log" >&2
printf 'fixture HTTP server did not become ready\n' >&2
exit 1
fi
success_output=$("$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets")
test "$success_output" = 'web_release_smoke=ok current_assets=1 compatibility_assets=1'
printf 'window.__LINGNIU_APP_CONFIG__={"amapSecurityJsCode":"must-not-ship"};\n' > "$fixture/served/app-config.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/exposed-config.out" 2>&1; then
printf 'expected an exposed AMap security code to fail\n' >&2
exit 1
fi
grep -q 'exposes the server-side AMap security code' "$fixture/exposed-config.out"
printf 'window.__LINGNIU_APP_CONFIG__={};\n' > "$fixture/served/app-config.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/missing-proxy.out" 2>&1; then
printf 'expected a missing AMap security proxy to fail\n' >&2
exit 1
fi
grep -q 'does not enable the server-side AMap proxy' "$fixture/missing-proxy.out"
cp "$fixture/web/app-config.js" "$fixture/served/app-config.js"
rm "$fixture/web/assets/old.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/missing.out" 2>&1; then
printf 'expected a missing compatibility asset to fail\n' >&2
exit 1
fi
grep -q 'compatibility asset is missing on disk' "$fixture/missing.out"
printf 'console.log("old");\n' > "$fixture/web/assets/old.js"
printf '\n' > "$fixture/served/assets/old.js"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/mismatch.out" 2>&1; then
printf 'expected a fallback response to fail byte comparison\n' >&2
exit 1
fi
grep -q 'response differs from release file' "$fixture/mismatch.out"
printf 'console.log("old");\n' > "$fixture/served/assets/old.js"
printf '../secret.js\n' > "$fixture/previous-assets"
if "$SCRIPT_DIR/verify-web-release.sh" "$fixture/web" "http://127.0.0.1:$port" "$fixture/previous-assets" > "$fixture/unsafe.out" 2>&1; then
printf 'expected an unsafe manifest path to fail\n' >&2
exit 1
fi
grep -q 'unsafe asset path' "$fixture/unsafe.out"
printf 'verify-web-release tests passed\n'