#!/usr/bin/env bash
# One-command runner for the RUNTIME AUTHZ HARNESS (scripts/runtime-authz-harness.ts).
# Stands up a throwaway Postgres, boots the REAL app, logs in as a tenant-scoped admin, and fires
# real cross-tenant HTTP requests — asserting the isolation guards reject them at runtime.
# Honest scope: runtime-verifies the IDOR/admin-trap isolation class. NOT a full pen-test/red-team.
set -uo pipefail
cd "$(dirname "$0")/.."

docker rm -f aegis-authz-pg >/dev/null 2>&1
docker run -d --name aegis-authz-pg -p 5433:5432 \
  -e POSTGRES_USER=aegis -e POSTGRES_PASSWORD=testpw -e POSTGRES_DB=aegis_test postgres:16-alpine >/dev/null 2>&1
for i in $(seq 1 40); do docker exec aegis-authz-pg pg_isready -U aegis -d aegis_test >/dev/null 2>&1 && break; sleep 1; done
sleep 2
docker exec aegis-authz-pg psql -U aegis -d aegis_test -c \
  "CREATE ROLE aegis_app LOGIN PASSWORD 'apppw'; CREATE ROLE aegis_rls_bypass BYPASSRLS;" >/dev/null 2>&1

export DATABASE_URL='postgres://aegis:testpw@localhost:5433/aegis_test'
export AEGIS_APP_DB_PASSWORD='apppw'
DATABASE_URL="$DATABASE_URL" npx drizzle-kit push --force >/dev/null 2>&1
docker exec aegis-authz-pg psql -U aegis -d aegis_test -c \
  "GRANT USAGE ON SCHEMA public TO aegis_app; GRANT ALL ON ALL TABLES IN SCHEMA public TO aegis_app; GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO aegis_app;" >/dev/null 2>&1

# All boot/runtime secrets (throwaway values). SECRET_GUARD_DEV_MODE + the cookie flags MUST be in the
# environment (read at import, before the harness's own process.env lines run).
K=$(printf '0%.0s' {1..64})
for v in PII_AES_MASTER_KEY PII_HMAC_MASTER_KEY ENCRYPTION_KEY MACHINE_KEY_SALT EXAMINER_TOKEN_SALT \
         SESSION_SECRET REGULATOR_SEED_PASSWORD WAVE10_SIGNING_SECRET WAVE10_PDF_SECRET \
         DEMO_PACK_SIGNING_SECRET SLSA_SIGNING_SECRET ONBOARD_SIGNING_SECRET CROSS_PILLAR_SIGNING_SECRET \
         TENANT_EXPORT_SIGNING_SECRET TENANT_EXPORT_KEY AEGIS_ADMIN_PASSWORD AEGIS_CISO_PASSWORD \
         AEGIS_AUDITOR_PASSWORD ENGINEER_OKOT_PASSWORD ENGINEER_OKELLO_PASSWORD MLCO_PASSWORD; do export $v="$K"; done
export SECRET_GUARD_DEV_MODE=warn COOKIE_SECURE=false AEGIS_ALLOW_INSECURE_COOKIE=true

timeout 180 npx tsx scripts/runtime-authz-harness.ts
rc=$?
docker rm -f aegis-authz-pg >/dev/null 2>&1
exit $rc