#!/usr/bin/env bash

# A project's mise.lock may name where to download a tool from. That is only
# honored once the user vouches for the project; safe mode vouches for nothing,
# so a trusted project (or CI, which counts as trusted) must still have its
# lockfile's artifact URLs ignored there.

export MISE_LOCKFILE=1
export MISE_TRUSTED_CONFIG_PATHS=""
unset CI GITHUB_ACTIONS GITHUB_ACTION 2>/dev/null || true

mkdir -p proj
cd proj || exit 1
echo '[tools]
"github:mvdan/sh" = "3.10.0"' >mise.toml
mise trust mise.toml
detect_platform
mise lock --platform "$MISE_PLATFORM"
assert_contains "cat mise.lock" "url = "
sed -i -e 's|^url = .*|url = "http://127.0.0.1:9/shfmt"|' -e "/^url_api = /d" mise.lock

# control: a trusted project outside safe mode downloads from the locked URL
assert_fail "mise install --force"

# safe mode ignores the locked URL and downloads from where the backend would
assert_succeed "MISE_SAFE=1 mise install --force"
assert_contains "MISE_SAFE=1 mise x github:mvdan/sh -- shfmt --version" "3.10.0"

# Locked mode in safe mode resolves the download from the backend, since the
# lockfile's URLs are ignored, and still checks it against the locked checksum.
rm mise.lock
mise lock --platform "$MISE_PLATFORM"
assert_succeed "MISE_SAFE=1 mise install --force --locked"
sed -i 's|^checksum = "sha256:.*"|checksum = "sha256:0000000000000000000000000000000000000000000000000000000000000000"|' mise.lock
assert_fail "MISE_SAFE=1 mise install --force --locked"

# Same for a registry tool installed by the aqua backend.
echo '[tools]
shfmt = "3.10.0"' >mise.toml
rm mise.lock
mise lock --platform "$MISE_PLATFORM"
assert_succeed "MISE_SAFE=1 mise install --force --locked"
sed -i 's|^checksum = "sha256:.*"|checksum = "sha256:0000000000000000000000000000000000000000000000000000000000000000"|' mise.lock
assert_fail "MISE_SAFE=1 mise install --force --locked"

# An aube-locked npm tool keeps its dependency graph in safe mode: the graph
# pins integrity hashes and the packages come from the configured registry.
echo '[tools]
"npm:prettier" = "3.3.3"' >mise.toml
rm mise.lock
mise lock --platform "$MISE_PLATFORM"
assert_contains "cat mise.lock" "aube = "
assert_succeed "MISE_SAFE=1 mise install --force --locked"
assert_contains "MISE_SAFE=1 mise x npm:prettier -- prettier --version" "3.3.3"

# A core backend resolves its own download the same way (#15363).
echo '[tools]
go = "1.23.4"' >mise.toml
rm mise.lock
mise lock --platform "$MISE_PLATFORM"
assert_succeed "MISE_SAFE=1 mise install --force --locked"
sed -i 's|^checksum = "sha256:.*"|checksum = "sha256:0000000000000000000000000000000000000000000000000000000000000000"|' mise.lock
assert_fail "MISE_SAFE=1 mise install --force --locked"

# Node downloads from its mirror once the URL is dropped, and must still check
# the locked checksum instead of replacing it with the mirror's.
echo '[tools]
node = "22.12.0"' >mise.toml
rm mise.lock
mise lock --platform "$MISE_PLATFORM"
assert_succeed "MISE_SAFE=1 mise install --force --locked"
sed -i 's|^checksum = "sha256:.*"|checksum = "sha256:0000000000000000000000000000000000000000000000000000000000000000"|' mise.lock
assert_fail "MISE_SAFE=1 mise install --force --locked"
