#!/bin/bash
# Smoke-test safe config parser (no network). Run from repo root.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=ssh-monitor-perms.sh
source "$ROOT/ssh-monitor-perms.sh"

tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
cfg="$tmpdir/test.conf"

cat >"$cfg" <<'EOF'
# comment
TELEGRAM_BOT_TOKEN="tok"
UseSAC="exclusive"
SAC_URL="https://sac.example.test"
WHITELIST_IPS="127.0.0.1,10.0.0.5"
WHITELIST_SUBNETS="10.0.0.0/24"
BACKUP_WEBHOOK_URL="https://hooks.example/legacy"
UNKNOWN_KEY="ignored"
EOF

ssh_monitor_config_load_file "$cfg"

[ "${TELEGRAM_BOT_TOKEN:-}" = "tok" ] || {
	echo "FAIL: TELEGRAM_BOT_TOKEN" >&2
	exit 1
}
[ "${UseSAC:-}" = "exclusive" ] || {
	echo "FAIL: UseSAC" >&2
	exit 1
}

ips_csv="${WHITELIST_IPS:-}"
subs_csv="${WHITELIST_SUBNETS:-}"
WHITELIST_IPS=()
WHITELIST_SUBNETS=()
IFS=',' read -r -a WHITELIST_IPS <<<"$ips_csv"
IFS=',' read -r -a WHITELIST_SUBNETS <<<"$subs_csv"

ssh_monitor_validate_config_values || {
	echo "FAIL: validate_config_values" >&2
	exit 1
}

printf 'EVIL="$(id)"\n' >"$tmpdir/bad.conf"
if ssh_monitor_config_load_file "$tmpdir/bad.conf" 2>/dev/null; then

echo "OK: config parser smoke test passed"