#!/bin/bash
# gen-asset-manifest.sh — extracts the canonical bytes of each managed asset
# heredoc from the provisioning scripts, sha256s them, and (re)writes
# spinifex/bootstrap/preflight/manifest_gen.go.
#
# Run this after editing a managed heredoc in setup.sh or setup-ovn.sh.
# manifest_gen_test.go re-extracts the same heredocs and fails if the
# committed manifest no longer matches, catching drift in CI.
#
# Usage: scripts/gen-asset-manifest.sh
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
OUT="$ROOT/spinifex/bootstrap/preflight/manifest_gen.go"

# extract_heredoc FILE ANCHOR
# Prints the body of the first quoted 'HELPER' heredoc starting after the
# first line containing ANCHOR — both scripts hold more than one such heredoc.
extract_heredoc() {
	local file=$1 anchor=$2
	awk -v anchor="$anchor" '
		state == 0 && index($0, anchor) { state = 1; next }
		state == 1 && index($0, "<<") && index($0, "HELPER") { state = 2; next }
		state == 2 && $0 == "HELPER" { exit }
		state == 2 { print }
	' "$file"
}

sysctl_hash=$(extract_heredoc "$ROOT/scripts/setup.sh" 'install_endpoint_sysctl_helper()' | sha256sum | cut -d' ' -f1)
ovs_hash=$(extract_heredoc "$ROOT/scripts/setup-ovn.sh" 'Step 8: Grant the spinifex service users access to OVS/OVN' | sha256sum | cut -d' ' -f1)

if [ -z "$sysctl_hash" ] || [ -z "$ovs_hash" ]; then
	echo "gen-asset-manifest.sh: failed to extract one or both heredocs — anchors may be stale" >&2
	exit 1
fi

mkdir -p "$(dirname "$OUT")"
cat >"$OUT" <<EOF
// Code generated by scripts/gen-asset-manifest.sh; DO NOT EDIT.

package preflight

var canonicalHashes = map[string]string{
	"/usr/local/lib/spinifex/spinifex-set-endpoint-sysctl": "$sysctl_hash",
	"/usr/local/lib/spinifex/ovs-socket-perms.sh":          "$ovs_hash",
}
EOF

if command -v gofmt >/dev/null 2>&1; then
	gofmt -w "$OUT"
fi

echo "wrote $OUT"
echo "  spinifex-set-endpoint-sysctl: $sysctl_hash"
echo "  ovs-socket-perms.sh:          $ovs_hash"