#!/bin/sh
# Probe host capabilities needed for a real login-manager deployment.
#
# This script never reports an unavailable capability as a pass. On an
# ordinary container it prints SKIP and exits successfully; --strict turns
# every SKIP into a failure for a prepared VM or privileged runner.
set -u

binary=${1:-}
strict=0
if [ "${1:-}" = "--strict" ]; then
    strict=1
    shift
    binary=${1:-}
fi

failures=0
skips=0
passes=0

pass() {
    passes=$((passes + 1))
    printf 'PASS: %s\n' "$*"
}

skip() {
    skips=$((skips + 1))
    printf 'SKIP: %s\n' "$*"
}

fail() {
    failures=$((failures + 1))
    printf 'FAIL: %s\n' "$*" >&2
}

need_command() {
    command -v "$1" >/dev/null 2>&1
}

if [ -n "$binary" ]; then
    if [ ! -x "$binary" ]; then
        fail "latchd binary is not executable: $binary"
    else
        pass "latchd binary is available"
    fi
else
    skip "latchd binary not supplied; capability-only probe"
fi

# This is deliberately a runtime capability check, not an authentication
# claim. Authentication needs a disposable VM user and a test PAM policy.
if need_command ldconfig && ldconfig -p 2>/dev/null | grep -q 'libpam\.so'; then
    pass "PAM runtime library is available"
else
    skip "PAM runtime library is unavailable"
fi
if [ -n "$binary" ] && need_command nm && nm -D "$binary" 2>/dev/null | grep -q 'pam_chauthtok'; then
    pass "PAM password-change entry point is linked"
else
    skip "PAM password-change entry point could not be inspected"
fi
if [ -r /etc/pam.d/latchd ]; then
    pass "latchd PAM policy is installed"
else
    skip "latchd PAM policy is not installed (authentication E2E requires a provisioned VM)"
fi
if need_command faillock; then
    pass "faillock helper is available"
else
    skip "faillock helper is unavailable"
fi

# A real VT is a character device and must be allocated by the host/VM. A
# pseudo-terminal from CI is not equivalent and is intentionally not accepted.
if [ -c /dev/tty0 ] && [ -d /sys/class/tty/tty0 ]; then
    pass "Linux virtual terminal device is available"
else
    skip "Linux virtual terminal is unavailable (container or non-console host)"
fi

# Xvfb is a genuine X server and is safe to exercise without host display
# access. If it is absent, this is a skip rather than a synthetic success.
if need_command Xvfb; then
    display_number=$((100 + ($$ % 500)))
    display=":$display_number"
    xlog=${TMPDIR:-/tmp}/latchd-xvfb.$$.log
    Xvfb "$display" -screen 0 640x480x24 -nolisten tcp >"$xlog" 2>&1 &
    xvfb_pid=$!
    cleanup_xvfb() {
        kill "$xvfb_pid" >/dev/null 2>&1 || true
        wait "$xvfb_pid" >/dev/null 2>&1 || true
        rm -f "$xlog"
    }
    trap cleanup_xvfb EXIT HUP INT TERM
    ready=0
    i=0
    while [ "$i" -lt 20 ]; do
        if [ -S "/tmp/.X11-unix/X$display_number" ] && kill -0 "$xvfb_pid" 2>/dev/null; then
            ready=1
            break
        fi
        i=$((i + 1))
        sleep 0.1
    done
    if [ "$ready" -eq 1 ]; then
        pass "X11 server starts in an isolated display ($display)"
    else
        fail "Xvfb did not start; see $xlog"
    fi
    cleanup_xvfb
    trap - EXIT HUP INT TERM
else
    skip "Xvfb is unavailable"
fi

# A Wayland socket is meaningful only when a compositor owns it. Do not claim
# Wayland support merely because a client library or executable is installed.
wayland_socket=
if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -n "${XDG_RUNTIME_DIR:-}" ]; then
    case "$WAYLAND_DISPLAY" in
        /*) wayland_socket=$WAYLAND_DISPLAY ;;
        *) wayland_socket=$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY ;;
    esac
fi
if [ -n "$wayland_socket" ] && [ -S "$wayland_socket" ]; then
    pass "Wayland compositor socket is available ($wayland_socket)"
else
    skip "Wayland compositor socket is unavailable (requires a compositor-backed VM/session)"
fi

# systemd-logind is not normally PID 1 in a Docker container. loginctl output
# is checked only when the manager and seat are actually reachable.
if need_command loginctl && [ -d /run/systemd/system ]; then
    if loginctl --no-pager show-seat seat0 >/dev/null 2>&1; then
        pass "systemd-logind seat0 is reachable"
    else
        fail "systemd-logind is present but seat0 is not reachable"
    fi
else
    skip "systemd-logind seat0 is unavailable"
fi

printf 'E2E summary: pass=%s skip=%s fail=%s\n' "$passes" "$skips" "$failures"
if [ "$failures" -ne 0 ]; then
    exit 1
fi
if [ "$strict" -eq 1 ] && [ "$skips" -ne 0 ]; then
    echo "E2E strict mode: unavailable capabilities are errors" >&2
    exit 2
fi
exit 0