#!/usr/bin/env bash
set -euo pipefail
# Requires existing version-matched binary and installed checkout dependencies.
cat > /tmp/issue23408-provenance.cjs <<'ISSUE23408_EOF'
const tls = require('node:tls');
console.log(JSON.stringify({execPath:process.execPath,execArgv:process.execArgv,argv:process.argv,ELECTRON_RUN_AS_NODE:process.env.ELECTRON_RUN_AS_NODE,NODE_USE_SYSTEM_CA:process.env.NODE_USE_SYSTEM_CA??'<unset>',NODE_EXTRA_CA_CERTS:process.env.NODE_EXTRA_CA_CERTS??'<unset>',versions:process.versions,platform:process.platform,caCounts:Object.fromEntries(['default','bundled','system','extra'].map(type=>[type,tls.getCACertificates(type).length]))}));

ISSUE23408_EOF
cat > /tmp/issue-23408-hosts.cjs <<'ISSUE23408_EOF'
const https = require('node:https');
console.log(JSON.stringify({platform:process.platform,versions:process.versions,extraCA:!!process.env.NODE_EXTRA_CA_CERTS,systemCA:process.env.NODE_USE_SYSTEM_CA}));
Promise.all(process.argv.slice(2).map(host=>new Promise(resolve=>{
 const req=https.get('https://'+host,res=>{console.log(host,res.statusCode);res.resume();resolve();});
 req.setTimeout(15000,()=>req.destroy(new Error('timeout')));
 req.on('error',e=>{console.log(host,e.code||e.message);resolve();});
})));

ISSUE23408_EOF
cat > /tmp/issue23408-negative.cjs <<'ISSUE23408_EOF'
const https=require('node:https'); const fs=require('node:fs');
const server=https.createServer({key:fs.readFileSync('/tmp/issue23408-negative.key'),cert:fs.readFileSync('/tmp/issue23408-negative.crt')},(_req,res)=>res.end('unexpected trust'));
server.listen(0,'127.0.0.1',()=>{
 const req=https.get({hostname:'127.0.0.1',port:server.address().port},res=>{console.log('UNEXPECTED HTTP',res.statusCode);res.resume();server.close();process.exitCode=1;});
 req.on('error',e=>{console.log('negative-control',e.code);server.close();process.exitCode=e.code==='DEPTH_ZERO_SELF_SIGNED_CERT'?0:1;});
 req.setTimeout(5000,()=>req.destroy(new Error('timeout')));
});

ISSUE23408_EOF
cat > /tmp/issue23408-capture.py <<'ISSUE23408_EOF'
import os, subprocess, shlex, pathlib, time, urllib.request, socket, signal
out=pathlib.Path('/tmp/issue23408-captures'); out.mkdir(exist_ok=True)
env=dict(os.environ); env.pop('NODE_USE_SYSTEM_CA',None); env.pop('NODE_EXTRA_CA_CERTS',None); env.pop('NODE_OPTIONS',None); env['ELECTRON_RUN_AS_NODE']='1'; env['T3CODE_LOG_LEVEL']='Debug'
binary='/tmp/issue23408-electron-44.9.3/electron'
prefix='env -u NODE_USE_SYSTEM_CA -u NODE_EXTRA_CA_CERTS -u NODE_OPTIONS ELECTRON_RUN_AS_NODE=1 '
with (out/'runtime.txt').open('w') as log:
 for flags in [[],['--use-system-ca']]:
  cmd=[binary,*flags,'--require','/tmp/issue23408-provenance.cjs','/tmp/issue-23408-hosts.cjs','relay.t3.codes','example.com','www.wikipedia.org','letsencrypt.org','api.github.com','www.apple.com']
  log.write('\n$ '+prefix+shlex.join(cmd)+'\n'); log.flush()
  result=subprocess.run(cmd,env=env,stdout=log,stderr=subprocess.STDOUT,timeout=60); log.write(f'exit={result.returncode}\n')
with socket.socket() as s:
 s.bind(('127.0.0.1',0)); port=s.getsockname()[1]
base=str(out/'isolated-server-home')
cmd=[binary,'--use-system-ca','--require','/tmp/issue23408-provenance.cjs','apps/server/src/bin.ts','--base-dir',base,'--host','127.0.0.1','--port',str(port),'--no-browser']
with (out/'server-raw.txt').open('w') as log:
 log.write('$ '+prefix+shlex.join(cmd)+'\n'); log.flush()
 proc=subprocess.Popen(cmd,cwd='/home/ubuntu/wt/issue-23408',env=env,stdout=log,stderr=subprocess.STDOUT)
 log.write(f'owned_spawn_pid={proc.pid}\n'); log.flush()
 try:
  deadline=time.monotonic()+90
  while time.monotonic()<deadline and proc.poll() is None:
   try:
    with urllib.request.urlopen(f'http://127.0.0.1:{port}/', timeout=1) as response:
     log.write(f'HTTP readiness GET / status={response.status}\n')
   except urllib.error.HTTPError as e:
    log.write(f'HTTP GET / status={e.code}; body={e.read(300).decode()}\n')
   except (OSError,urllib.error.URLError): pass
   log.flush()
   if 'startup phase: complete' in (out/'server-raw.txt').read_text():
    log.write('READINESS CONFIRMED: startup phase: complete (after command gate and ready event)\n'); break
   time.sleep(.5)
  else: log.write(f'readiness not reached; process_exit={proc.poll()}\n')
 finally:
  if proc.poll() is None:
   log.write(f'SIGTERM owned_spawn_pid={proc.pid}\n'); proc.terminate()
   try: proc.wait(timeout=15)
   except subprocess.TimeoutExpired:
    log.write(f'SIGKILL owned_spawn_pid={proc.pid}\n'); proc.kill(); proc.wait()
  log.write(f'owned process exit={proc.returncode}\n')

ISSUE23408_EOF
python3 /tmp/issue23408-capture.py
openssl req -x509 -newkey rsa:2048 -nodes -keyout /tmp/issue23408-negative.key -out /tmp/issue23408-negative.crt -days 1 -subj /CN=localhost
env -u NODE_USE_SYSTEM_CA -u NODE_EXTRA_CA_CERTS -u NODE_OPTIONS ELECTRON_RUN_AS_NODE=1 /tmp/issue23408-electron-44.9.3/electron --use-system-ca --require /tmp/issue23408-provenance.cjs /tmp/issue23408-negative.cjs
# Focused tests (red expected exit 1; green expected exit 0):
# mkdir /tmp/issue23408-red-repro
# git -C /home/ubuntu/wt/issue-23408 archive aff87ef38b | tar -x -C /tmp/issue23408-red-repro
# Symlink installed root/apps/packages node_modules directories to the matching paths in red-repro (dependencies only).
# cd /tmp/issue23408-red-repro && vp test run apps/desktop/src/backend/DesktopBackendConfiguration.test.ts
# cd /home/ubuntu/wt/issue-23408 && vp test run apps/desktop/src/backend/DesktopBackendConfiguration.test.ts