control 'deploy_ny_host' do
  title 'Checking deploy_ny_host recipe'
  attribute_file = '/tmp/kitchen/node_attributes.json'
  if file(attribute_file).exist?
    node = json(attribute_file).params

    jenkins_user = node['default']['jenkins']['user']
    jenkins_home_dir = node['default']['jenkins']['jenkins_home_dir']

    describe user(jenkins_user) do
      it { should exist }
      its('home') { should eq jenkins_home_dir }
      its('shell') { should eq '/bin/bash' }
      its('groups') { should include 'docker' }
    end

    describe directory("#{jenkins_home_dir}/.ssh") do
      it { should exist }
      its('owner') { should eq jenkins_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0700' }
    end

    describe file("#{jenkins_home_dir}/.ssh/config") do
      it { should exist }
      its('owner') { should eq jenkins_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0600' }
      its('content') { should match(/Host \*(\n\t)StrictHostKeyChecking no\n/) }
    end

    pub_key = 'AAAAB3NzaC1yc2EAAAADAQABAAACAQCiosRmf5zPirdrZ1PGjh5oekGS5V5wlb3/BH4XUq2VkpvCPZn0cKZqPhLNfVSRcyEm9Zbtx5Z+Vquzu/28g13VZx+JfJstEF35/ux0FPa2xjsnxmrkIakrhqe/xLzEJxMsFsWXmAiG0wTOv6dMrebpkvyshde1OkYOfqy6mJgStyxSFnk86Ij6krW6+6hFSbyOoYI4XPH98F0Ng8KAXy2OhqFIGpNMeoz+uRgmPgqVwC+/ZKyZO/xO01MUPBIUFTAD0DUEyXhrRyehGRopCK6jhxaclu6Nmy2jc7QLOWgSIr/Pn9KxwCa64MdOcGx962QMP0mYXUIH158HLejllDWwJMrzSXgKl2MQ96AdzbW72zV6did8ZUPPKLOaBAH5eNiDZzBlqLwWUQPBgHVxam3mCJdAUk/t2zowPsgGllgOSwvcRTX5/PJsWoo4lEOnqz32bcq2vcyB1JEWjFgt9BjzhrvoZvBudWPAeKXRP6HxotUpql5WzZtKuhre8RLhLjXY0az2TbSlCgPrgkr1OtdZfJzK6gel/q9HKt9bj99H3jEdROBkTfNIi5p3fbq4Ot9j70i9LcsT7Uikq5bS0j4spHClJrHkC+xXuwDtaP1oxglZARR/EVyWHTRp1HtRnTmccbyySN8BOMqh+KuhUr1IlnDANiIRFg6eeDa60hK8Bw=='
    describe file("#{jenkins_home_dir}/.ssh/authorized_keys") do
      it { should exist }
      its('content') { should include pub_key }
    end

    require 'json'

    data_bag_path = 'chef_repo/data_bags/secrets/jenkins_agent_ssh_private_key.json'
    data_bag_item = JSON.parse(File.read(data_bag_path)).to_hash

    private_key = data_bag_item['key']

    describe file("#{jenkins_home_dir}/.ssh/id_rsa") do
      it { should exist }
      its('owner') { should eq jenkins_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0600' }
      its('content') { should eq private_key }
    end

    describe directory("#{jenkins_home_dir}/.aws") do
      it { should exist }
      its('owner') { should eq jenkins_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0755' }
    end

    encrypted_path = '../../chef_repo/data_bags/secrets/jenkins_aws_credentials.json'
    encrypted_data = JSON.parse(File.read(encrypted_path))
    jenkins_aws_credentials = Chef::EncryptedDataBagItem.new(encrypted_data, secret).to_hash
    access_key_id = jenkins_aws_credentials['access_key_id']
    secret_access_key = jenkins_aws_credentials['secret_access_key']
    describe file("#{jenkins_home_dir}/.aws/credentials"), :sensitive do
      it { should exist }
      its('owner') { should eq jenkins_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0644' }
      its('content') { should include "access_key_id = #{access_key_id}" }
      its('content') { should include "secret_access_key = #{secret_access_key}" }
    end

    # AWS config will be only partialy checked, because inspec have no template resource
    describe file("#{jenkins_home_dir}/.aws/config"), :sensitive do
      it { should exist }
      its('owner') { should eq jenkins_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0644' }
      its('content') { should include "access_key_id = #{access_key_id}" }
      its('content') { should include "secret_access_key = #{secret_access_key}" }
    end

    fabric_user = node['default']['jenkins']['fabric_user']
    fabric_home_dir = node['default']['jenkins']['fabric_home_dir']
    describe user(fabric_user) do
      it { should exist }
      its('home') { should eq fabric_home_dir }
      its('shell') { should eq '/bin/bash' }
    end

    describe directory(fabric_home_dir) do
      it { should exist }
      its('owner') { should eq fabric_user }
      its('group') { should eq jenkins_user }
      its('mode') { should cmp '0750' }
    end

    describe file("/etc/sudoers.d/#{jenkins_user}") do
      it { should exist }
      its('owner') { should eq 'root' }
      its('group') { should eq 'root' }
      its('mode') { should cmp '0440' }
      its('content') { should include "#{jenkins_user}  ALL=(#{fabric_user}) NOPASSWD: ALL" }
    end

    describe directory("#{fabric_home_dir}/.ssh") do
      it { should exist }
      its('owner') { should eq fabric_user }
      its('group') { should eq fabric_user }
      its('mode') { should cmp '0700' }
    end

    describe file("#{fabric_home_dir}/.ssh/config") do
      it { should exist }
      its('owner') { should eq fabric_user }
      its('group') { should eq fabric_user }
      its('mode') { should cmp '0600' }
      its('content') { should match(/Host \*(\n\t)StrictHostKeyChecking no\n/) }
    end

    fabric_rsa_path = '../../chef_repo/data_bags/secrets/qa_fabric_deploy_ssh_private_key.json'
    fabric_rsa_data = JSON.parse(File.read(fabric_rsa_path))
    fabric_rsa = Chef::EncryptedDataBagItem.new(fabric_rsa_data, secret).to_hash
    fabric_private_key = fabric_rsa['key'].chomp
    describe file("#{fabric_home_dir}/.ssh/id_rsa"), :sensitive do
      it { should exist }
      its('owner') { should eq fabric_user }
      its('group') { should eq fabric_user }
      its('mode') { should cmp '0600' }
      its('content') { should eq fabric_private_key }
    end

    describe command('yum repolist') do
      its('stdout') { should include 'Extra Packages for Enterprise Linux 7' }
    end

    # Required packages for deploy hosts
    packages = %w(
      git
      gcc
      openssl-devel
      subversion
      java-11-openjdk-devel
      zip
      unzip
    )
    packages.each do |package|
      describe package(package) do
        it { should be_installed }
      end
    end

    describe package('python') do
      it { should be_installed }
      its('version') { should match(/2\.7/) }
    end

    python_packages = %w(
      awscli
      awsebcli
      boto
    )
    # python package 'fabric' - couldn't check if it's installed, because it's wrapper

    python_packages.each do |pkg|
      describe command('pip list') do
        its('stdout') { should include pkg }
      end
    end

    parsley_url = 'git@github.com:/theorchard/parsley.git'
    describe file("#{fabric_home_dir}/parsley/.git/config") do
      it { should exist }
      its('owner') { should eq fabric_user }
      its('group') { should eq fabric_user }
      its('content') { should match(/url = #{parsley_url}/) }
    end

  else
    puts "File #{attribute_file} does not exist, skiping attribute-depending checks"
  end
end