#!/bin/sh
# Caller owns a unique temporary directory and removes it by marker afterwards.
set +vx
set -eu
base=$1
dispatcher=$2
cd "$base"
umask 077
export HOME="$base" GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
git -c include.path=/data/home/.gitconfig init -q --bare server.git
git init -q -b main client
git -C client config core.hooksPath "$base/no-hooks"
git -C client config user.name 'Custodian isolated receive probe'
git -C client config user.email 'probe@example.test'
test -x server.git/hooks/pre-receive.d/10-custodian-secret-scan
cp "$dispatcher" server.git/hooks/pre-receive
chmod 755 server.git/hooks/pre-receive
# No production database identity: native dispatcher with only the inherited scan hook.
printf 'clean baseline\n' > client/source.txt
git -C client add source.txt
git -C client commit -qm 'isolated clean baseline'
git -C client push "$base/server.git" HEAD:refs/heads/main > clean.out 2>&1
grep -q '"status":"clean"' clean.out
initial=$(git -C client rev-parse HEAD)
ssh-keygen -q -t ed25519 -N '' -f "$base/synthetic-key" >/dev/null 2>&1
cp synthetic-key client/fixture.txt
git -C client add fixture.txt
git -C client commit -qm 'isolated synthetic fixture'
rejected=$(git -C client rev-parse HEAD)
git -C client rm -q fixture.txt
git -C client commit -qm 'remove fixture from final tree'
if git -C client push "$base/server.git" HEAD:refs/heads/main > blocked.out 2>&1; then exit 22; fi
grep -q '"status":"blocked"' blocked.out
if grep -q 'BEGIN OPENSSH PRIVATE KEY' blocked.out; then exit 23; fi
if git -C server.git cat-file -e "$rejected" >/dev/null 2>&1; then exit 24; fi
test "$(git -C server.git rev-parse refs/heads/main)" = "$initial"
git -C client checkout -qb recovery "$initial"
printf 'clean recovery\n' > client/source.txt
git -C client add source.txt
git -C client commit -qm 'isolated clean recovery'
git -C client push "$base/server.git" HEAD:refs/heads/main > recovered.out 2>&1
grep -q '"status":"clean"' recovered.out
printf '{"inherited_installed_hook":true,"clean_push":true,"intermediate_secret_refused":true,"quarantine_discarded":true,"clean_recovery":true,"builtin_authorization_excluded":true}\n'