#!/usr/bin/env bash
set -euo pipefail

[[ "$#" -eq 1 && "$1" = /* ]] || {
  echo "usage: test-valheim-relay.sh NEW_OS_TEMP_DIRECTORY" >&2
  exit 2
}
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
work="$(realpath -m "$1")"
case "$work" in
  /tmp/* | /var/tmp/*) ;;
  *)
    echo "test requires an OS temporary directory" >&2
    exit 2
    ;;
esac
mkdir -m 0700 "$work"
mkdir "$work/bin"
trap 'rm -rf "$work"' EXIT

cat >"$work/bin/scp" <<'MOCK'
#!/usr/bin/env bash
set -euo pipefail
cp "$3" "$MOCK_STAGE"
MOCK
cat >"$work/bin/ssh" <<'MOCK'
#!/usr/bin/env bash
set -euo pipefail
cat >>"$MOCK_SSH_INPUT"
MOCK
chmod 0755 "$work/bin/scp" "$work/bin/ssh"
rendered="$work/rendered.nft"
# Template placeholders are literal; they must not be shell-expanded.
# shellcheck disable=SC2016
sed 's/\${wg_peer_ip}/10.100.0.2/; s/\${wg_peer_ipv6}/fd00:100::2/' "$repo_root/templates/valheim-relay.nft.tftpl" >"$rendered"

bash -n "$repo_root/scripts/local/deploy-valheim-relay.sh"
bash -n "$repo_root/scripts/remote/apply-valheim-relay.sh"
grep -Fx 'add rule inet filter forward iifname "eth0" oifname "wg0" ct status dnat ip daddr 10.100.0.2 udp dport { 2456, 2457 } accept comment "bugabinga-valheim-forward-ipv4"' "$rendered" >/dev/null
grep -Fx 'add rule ip6 nat prerouting iifname "eth0" udp dport { 2456, 2457 } dnat to fd00:100::2 comment "bugabinga-valheim-dnat-ipv6"' "$rendered" >/dev/null
PATH="$work/bin:$PATH" MOCK_STAGE="$work/fragment" MOCK_SSH_INPUT="$work/ssh-input" VALHEIM_RELAY_FRAGMENT="$(<"$rendered")" "$repo_root/scripts/local/deploy-valheim-relay.sh" 192.0.2.10 49200
cmp "$work/fragment" "$rendered"
grep -F 'apply-valheim-relay.sh' "$repo_root/valheim-relay.tf" >/dev/null
grep -F 'hcloud_firewall.this' "$repo_root/valheim-relay.tf" >/dev/null
printf '%s\n' 'Valheim relay fragment rendering, operator-SSH transfer mock, and Terraform dependency checks passed.'