#!/usr/bin/env bash
# Verify that the socktop binary baked into a built image understands every
# --flag the restricted/session shells pass to it.
#
# Why this exists: image 0.3.9 shipped with a cached apt layer holding socktop
# 1.60.1, while restricted-shell.sh had started passing --no-kill (added in
# 1.60.2). 1.60.1 parsed the unknown flag as the positional websocket URL,
# prompted to overwrite the 'local' profile with url "--no-kill", and broke the
# demo. This check fails the build whenever the shells and the installed
# binary disagree about the CLI.
#
# Usage: verify-image-socktop-flags.sh IMAGE
set -euo pipefail

IMAGE="${1:?usage: verify-image-socktop-flags.sh IMAGE}"
cd "$(dirname "$0")/.."

# Every --flag appearing on a socktop invocation line in the shells.
FLAGS=$(grep -hE '/usr/bin/socktop' docker/restricted-shell.sh docker/session-shell.sh 2>/dev/null |
    grep -oE -- '--[a-z][a-z-]*' | sort -u)
if [ -z "$FLAGS" ]; then
    echo "ERROR: found no socktop flags to verify — did the shells move?" >&2
    exit 1
fi

# The image is arm64-only; pin the platform so the check behaves the same on
# the arm64 CI runner and on an amd64 box with qemu binfmt.
run_socktop() {
    docker run --rm --platform linux/arm64 --entrypoint /usr/bin/socktop "$IMAGE" "$@" 2>&1
}

if ! VERSION=$(run_socktop --version); then
    echo "ERROR: could not run socktop from ${IMAGE}:" >&2
    echo "$VERSION" >&2
    exit 1
fi
HELP=$(run_socktop --help || true)
echo "image socktop: ${VERSION}"

rc=0
for flag in $FLAGS; do
    if printf '%s' "$HELP" | grep -q -- "$flag"; then
        echo "  ok: $flag"
    else
        echo "  MISSING: installed socktop does not document $flag" >&2
        rc=1
    fi
done

if [ "$rc" -ne 0 ]; then
    echo "FAIL: the image's socktop predates flags the shells pass." >&2
    echo "Bump SOCKTOP_VERSION in the Dockerfile to a release that has them." >&2
fi
exit $rc