#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
command -v bwrap >/dev/null || { echo 'bwrap requis' >&2; exit 1; }
BASE="$(mktemp -d)"; trap 'rm -rf -- "$BASE"' EXIT
mkdir -p "$BASE"/{bin,tmp,proc/pressure,sys/class/power_supply/BAT1,repo/scripts}
for p in cpu memory io; do printf 'fixture\n' > "$BASE/proc/pressure/$p"; done
printf '60\n' > "$BASE/sys/class/power_supply/BAT1/charge_control_end_threshold"
cp "$ROOT/scripts/audit.sh" "$BASE/repo/scripts/audit.sh"
cp "$ROOT/tests/audit/mock-command.sh" "$BASE/mock-command.sh"
for cmd in uptime free swapon cat df sudo ps systemctl pgrep systemd-analyze; do ln -s /opt/mock-command.sh "$BASE/bin/$cmd"; done
ln -s /usr/bin/bash "$BASE/bin/bash"
ln -s /usr/bin/sed "$BASE/bin/sed"
run_case() {
    local label="$1"; shift
    : > "$BASE/tmp/calls"
    set +e
    bwrap --unshare-user --unshare-pid --unshare-net --tmpfs / \
      --ro-bind /usr /usr --symlink usr/lib /lib --symlink usr/lib /lib64 \
      --symlink usr/bin /bin --tmpfs /opt \
      --ro-bind "$BASE/repo" /opt/repo --ro-bind "$BASE/bin" /opt/bin \
      --ro-bind "$BASE/mock-command.sh" /opt/mock-command.sh \
      --bind "$BASE/tmp" /tmp --bind "$BASE/proc" /proc --bind "$BASE/sys" /sys --dev /dev \
      --setenv PATH /opt/bin --setenv FAIL "${FAIL:-}" \
      -- /opt/repo/scripts/audit.sh > "$BASE/out" 2>&1
    rc=$?
    set -e
    printf '[test] %s : rc=%s\n' "$label" "$rc"
}
run_case nominal; [[ "$rc" == 0 ]] || { cat "$BASE/out"; exit 1; }
grep -q 'Aucun processus correspondant observé' "$BASE/out"
grep -q 'enabled=disabled' "$BASE/out"
for scenario in pgrep_error service sudo ps; do
    FAIL="$scenario" run_case "$scenario"
    [[ "$rc" == 1 ]] || { cat "$BASE/out"; exit 1; }
    case "$scenario" in
        pgrep_error) grep -q 'Recherche de processus échouée' "$BASE/out"; ! grep -q 'Aucun processus correspondant observé' "$BASE/out" ;;
        service) grep -q 'ERREUR(47)' "$BASE/out" ;;
        sudo) grep -q 'Lecture échouée : sudo' "$BASE/out" ;;
        ps) grep -q 'Lecture échouée : ps' "$BASE/out" ;;
    esac
done
printf 'Résultat : 5 scénarios confinés de diagnostic validés.\n'