#!/usr/bin/env bash
# Isolated fixture for the desktop SSH reproduction. Run once on a disposable Linux host.
# Requires sudo, sshd on port 22, npm, curl, iptables, and ip6tables.
# Usage: bash fixture.sh <scratch-directory>
set -euo pipefail
fixture=$(realpath "$1")
mkdir -p "$fixture"
sudo useradd -m -d "$fixture/remote-home" -s /bin/bash proof22363
sudo passwd -d proof22363
sudo -u proof22363 npm install -g --prefix "$fixture/remote-home/.local" t3@0.1.8
sudo -u proof22363 "$fixture/remote-home/.local/bin/t3" --version
ssh-keygen -t ed25519 -N '' -f "$fixture/ssh-key" -C proof
sudo mkdir -p "$fixture/remote-home/.ssh"
sudo cp "$fixture/ssh-key.pub" "$fixture/remote-home/.ssh/authorized_keys"
sudo chown -R proof22363:proof22363 "$fixture/remote-home/.ssh"
sudo chmod 700 "$fixture/remote-home/.ssh"
sudo chmod 600 "$fixture/remote-home/.ssh/authorized_keys"
# Use an isolated SSH identity and known-host file. Do not replace an existing config.
test ! -e "$HOME/.ssh/config"
cat > "$HOME/.ssh/config" <<EOF
Host 127.0.0.1
  IdentityFile $fixture/ssh-key
  IdentitiesOnly yes
  StrictHostKeyChecking accept-new
  UserKnownHostsFile $fixture/known_hosts
EOF
chmod 600 "$HOME/.ssh/config"
ssh -o BatchMode=yes proof22363@127.0.0.1 true
sudo iptables -I OUTPUT 1 -m owner --uid-owner proof22363 -j REJECT
sudo iptables -I OUTPUT 1 -m owner --uid-owner proof22363 -o lo -p tcp -j ACCEPT
sudo ip6tables -I OUTPUT 1 -m owner --uid-owner proof22363 -j REJECT
ssh proof22363@127.0.0.1 '.local/bin/t3 --version; ls .t3/runtime/versions; curl --noproxy "*" -sS --connect-timeout 3 https://github.com' || test "$?" = 6
# Run desktop-proof.cjs once per built checkout, with the same fixture and fresh output directories.
# Cleanup after both runs: close desktop apps, remove these three exact firewall rules with -D,
# remove only the SSH config created here, delete the proof22363 account, then remove the fixture.