#!/usr/bin/env bash
set -euo pipefail

container_name="magent-ci-${GITHUB_RUN_ID:-local}-$$"
volume_name="${container_name}-data"
cleanup() {
  docker rm -f "$container_name" >/dev/null 2>&1 || true
  docker volume rm -f "$volume_name" >/dev/null 2>&1 || true
}
trap cleanup EXIT

docker build --tag magent:ci .
docker volume create "$volume_name" >/dev/null
docker run --rm --user 0 \
  --volume "$volume_name:/app/data" \
  --entrypoint chown \
  magent:ci -R 1000:1000 /app/data
docker run --detach --name "$container_name" \
  --read-only --cap-drop ALL --security-opt no-new-privileges:true \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m,uid=1000,gid=1000 \
  --tmpfs /app/frontend/.next/cache:rw,noexec,nosuid,size=128m,uid=1000,gid=1000 \
  --volume "$volume_name:/app/data" \
  --env JWT_SECRET=ci-only-secret-with-at-least-32-characters \
  --env SETTINGS_ENCRYPTION_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= \
  --env ADMIN_PASSWORD=ci-only-bootstrap-password-123 \
  magent:ci >/dev/null

deadline=$((SECONDS + 120))
until [ "$(docker inspect --format '{{.State.Health.Status}}' "$container_name")" = "healthy" ]; do
  if [ "$SECONDS" -ge "$deadline" ]; then
    docker logs "$container_name"
    echo "Container did not become healthy within 120 seconds" >&2
    exit 1
  fi
  sleep 2
done

docker exec "$container_name" curl --fail --silent --show-error http://127.0.0.1:8000/health >/dev/null
docker exec "$container_name" curl --fail --silent --show-error http://127.0.0.1:3000/login >/dev/null