name: Authentication acceptance
on:
  push:
    branches: [main]
    paths: ["src/**", "scripts/provider-onboarding-contract.py", ".forgejo/workflows/acceptance.yaml"]
  workflow_dispatch:
jobs:
  acceptance:
    runs-on: ubuntu-latest
    container:
      image: golang:1.23-alpine
    steps:
      - name: Test exact source revision
        run: |
          set -eu
          wget -qO /tmp/keycape-source.tar.gz "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
          mkdir -p /tmp/keycape-acceptance
          tar xzf /tmp/keycape-source.tar.gz -C /tmp/keycape-acceptance --strip-components=1
          cd /tmp/keycape-acceptance/src
          /usr/local/go/bin/go test ./...

  provider-contract:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473
    steps:
      - name: Exercise isolated provider enrollment and recovery
        run: |
          python3 - <<'PYCODE'
          import os,tarfile,tempfile,urllib.request,subprocess
          from pathlib import Path
          with tempfile.TemporaryDirectory(prefix='keycape-provider-ci-') as directory:
              root=Path(directory)
              url='https://forgejo.coulomb.social/'+os.environ['GITHUB_REPOSITORY']+'/archive/'+os.environ['GITHUB_SHA']+'.tar.gz'
              with urllib.request.urlopen(url,timeout=30) as response,tempfile.TemporaryFile() as archive:
                  archive.write(response.read());archive.seek(0)
                  with tarfile.open(fileobj=archive,mode='r:gz') as tar:tar.extractall(root,filter='data')
              script=next(root.glob('*/scripts/provider-onboarding-contract.py'))
              subprocess.run(['python3',str(script)],check=True,timeout=90)
          PYCODE