# Unit tests for basic user-data script structure
# These tests validate the template renders correctly without deploying infrastructure

variables {
  chef_role         = "test_role"
  aws_iam_role_id   = "test-iam-role"
  aws_instance_name = "test-instance"
}

# Test: Script uses bash strict mode
run "script_uses_strict_mode" {
  command = plan

  assert {
    condition     = can(regex("set -euo pipefail", output.user_data_output))
    error_message = "User data script must use bash strict mode (set -euo pipefail)"
  }
}

# Test: Script has proper shebang
run "script_has_bash_shebang" {
  command = plan

  assert {
    condition     = can(regex("^#!/bin/bash", output.user_data_output))
    error_message = "User data script must start with #!/bin/bash"
  }
}

# Test: Script uses IMDSv2 for instance ID
run "script_uses_imdsv2" {
  command = plan

  assert {
    condition     = can(regex("X-aws-ec2-metadata-token", output.user_data_output))
    error_message = "User data script must use IMDSv2 token-based authentication"
  }

  assert {
    condition     = can(regex("http://169\\.254\\.169\\.254/latest/api/token", output.user_data_output))
    error_message = "User data script must request IMDSv2 token"
  }
}

# Test: Script has error handling for S3 downloads
run "script_has_s3_error_handling" {
  command = plan

  assert {
    condition     = can(regex("if ! aws s3 cp", output.user_data_output))
    error_message = "User data script must have error handling for S3 downloads"
  }

  assert {
    condition     = can(regex("FATAL: Failed to download validator key", output.user_data_output))
    error_message = "User data script must log fatal error on validator key download failure"
  }
}

# Test: Script sets secure permissions on sensitive files
run "script_sets_secure_permissions" {
  command = plan

  assert {
    condition     = can(regex("chmod 600 /etc/cinc/orchard-validator\\.pem", output.user_data_output))
    error_message = "User data script must set chmod 600 on validator key"
  }

  assert {
    condition     = can(regex("chmod 600 /etc/cinc/encrypted_data_bag_secret", output.user_data_output))
    error_message = "User data script must set chmod 600 on encrypted data bag secret"
  }
}

# Test: Script has error handling for cinc-client
run "script_has_cinc_error_handling" {
  command = plan

  assert {
    condition     = can(regex("if ! cinc-client", output.user_data_output))
    error_message = "User data script must have error handling for cinc-client execution"
  }

  assert {
    condition     = can(regex("FATAL: Cinc client bootstrap failed", output.user_data_output))
    error_message = "User data script must log fatal error on cinc-client failure"
  }
}

# Test: Script exits on unsupported platform
run "script_exits_on_unsupported_platform" {
  command = plan

  assert {
    condition     = can(regex("Unsupported platform:", output.user_data_output))
    error_message = "User data script must handle unsupported platforms"
  }

  assert {
    condition     = can(regex("Unsupported architecture:", output.user_data_output))
    error_message = "User data script must handle unsupported architectures"
  }
}

# Test: Script creates required directories
run "script_creates_directories" {
  command = plan

  assert {
    condition     = can(regex("mkdir -p /etc/cinc", output.user_data_output))
    error_message = "User data script must create /etc/cinc directory"
  }

  assert {
    condition     = can(regex("mkdir -p.*/var/log/cinc", output.user_data_output))
    error_message = "User data script must create /var/log/cinc directory"
  }
}

# Test: Script configures chef client.rb
run "script_configures_chef_client" {
  command = plan

  assert {
    condition     = can(regex("cat > /etc/cinc/client\\.rb", output.user_data_output))
    error_message = "User data script must create client.rb configuration"
  }

  assert {
    condition     = can(regex("chef_server_url", output.user_data_output))
    error_message = "User data script must configure chef_server_url"
  }

  assert {
    condition     = can(regex("validation_client_name", output.user_data_output))
    error_message = "User data script must configure validation_client_name"
  }
}