#!/usr/bin/env bash
# A disposable preflight comparison with dummy values, never live credentials.
set -eu
umask 077
: "${CHIO_EVIDENCE:?Set a new private evidence directory}"
if [ -e "$CHIO_EVIDENCE" ]; then
  echo 'Refuse to reuse evidence' >&2
  exit 2
fi
mkdir -m 0700 "$CHIO_EVIDENCE"
run_case() {
  name=$1
  admin=$2
  if CHIO_AUTH_TOKEN=fixture-session CHIO_ADMIN_TOKEN="$admin" \
     CHIO_CONTROL_TOKEN=fixture-control \
     CHIO_REMOTE_AUTHORITY_WORKLOAD_TOKEN=fixture-workload \
     chio security preflight --json > "$CHIO_EVIDENCE/$name.json" \
                                  2> "$CHIO_EVIDENCE/$name.stderr"; then
    status=0
  else
    status=$?
  fi
  printf '%s\n' "$status" > "$CHIO_EVIDENCE/$name.exit"
}
run_case distinct fixture-admin
run_case reused fixture-session
python3 "$(dirname "$0")/compare_bearer_roles.py" "$CHIO_EVIDENCE"