#!/bin/sh
# Disposable bare repositories only; caller owns admission and exact cleanup.
set +vx
set -eu
base=$1
cd "$base"
umask 077
export HOME="$base/home" GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
mkdir home
trap 'chmod 755 "$base/gitleaks" >/dev/null 2>&1 || :' 0
sha256sum -c SHA256SUMS >/dev/null 2>&1
chmod 755 receive-secret-scan gitleaks
/usr/bin/git init -q --bare server.git
/usr/bin/git init -q -b main client
/usr/bin/git -C server.git config core.hooksPath "$base/server.git/hooks"
/usr/bin/git -C client config core.hooksPath "$base/no-client-hooks"
/usr/bin/git -C client config user.name 'Custodian disposable probe'
/usr/bin/git -C client config user.email 'probe@example.test'
mkdir server.git/hooks/pre-receive.d
cp pre-receive.fixture server.git/hooks/pre-receive
chmod 755 server.git/hooks/pre-receive
cat > server.git/hooks/pre-receive.d/gitea <<STUB
#!/bin/sh
cat >/dev/null
printf 'invoked\n' >> '$base/stub-calls'
STUB
cat > server.git/hooks/pre-receive.d/secret-scan <<HOOK
#!/bin/sh
exec '$base/receive-secret-scan' --scanner '$base/gitleaks'
HOOK
chmod 755 server.git/hooks/pre-receive.d/gitea server.git/hooks/pre-receive.d/secret-scan
printf 'clean baseline\n' > client/source.txt
/usr/bin/git -C client add source.txt
/usr/bin/git -C client commit -qm 'disposable clean baseline'
if ! /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > clean.out 2>&1; then exit 21; fi
grep -q '"status":"clean"' clean.out
initial=$(/usr/bin/git -C client rev-parse HEAD)
cp fixture-key client/secret.txt
/usr/bin/git -C client add secret.txt
/usr/bin/git -C client commit -qm 'disposable detector fixture'
rejected=$(/usr/bin/git -C client rev-parse HEAD)
/usr/bin/git -C client rm -q secret.txt
/usr/bin/git -C client commit -qm 'remove fixture from final tree'
if /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > blocked.out 2>&1; then exit 22; fi
grep -q '"status":"blocked"' blocked.out
if grep -q 'BEGIN OPENSSH PRIVATE KEY' blocked.out; then exit 23; fi
if /usr/bin/git -C server.git cat-file -e "$rejected" >/dev/null 2>&1; then exit 24; fi
test "$(/usr/bin/git -C server.git rev-parse refs/heads/main)" = "$initial"
/usr/bin/git -C client checkout -qb clean-retry "$initial"
printf 'clean recovery\n' > client/source.txt
/usr/bin/git -C client add source.txt
/usr/bin/git -C client commit -qm 'disposable clean recovery'
chmod 644 gitleaks
if /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > unavailable.out 2>&1; then exit 25; fi
grep -q '"status":"unverified"' unavailable.out
grep -q '"reason":"scanner-file-refused"' unavailable.out
chmod 755 gitleaks
if ! /usr/bin/git -C client push "$base/server.git" HEAD:refs/heads/main > recovered.out 2>&1; then exit 26; fi
grep -q '"status":"clean"' recovered.out
test "$(/usr/bin/git -C server.git rev-parse refs/heads/main)" = "$(/usr/bin/git -C client rev-parse HEAD)"
test "$(wc -l < stub-calls | tr -d ' ')" = 4
cmp pre-receive.fixture server.git/hooks/pre-receive
printf '{"clean_push":true,"intermediate_secret_refused":true,"quarantine_discarded":true,"scanner_unavailable_refused":true,"clean_after_recovery":true,"dispatcher_preserved":true,"other_hook_invocations":4,"builtin_authorization_stubbed":true}\n'