#!/bin/bash
# Stub environment for the fp-driver failure-path exercises.
#
# STUBS ONLY. Nothing here runs cargo, starts a listener, elevates, calls
# NetSecurity, or touches a firewall rule. Every stub RECORDS the action the
# driver REQUESTED and returns a scripted result; none performs it.
#
# doyle 2026-09-12: record actual requested ACTIONS AND ORDERING, not messages.
# So every stub appends one line to a single ordered actions.log; the sequence
# in that file IS the ordering evidence. Nothing infers elevation: the log
# records the argv and the opt-out variable as they were passed, and says
# nothing about privilege, which a comment cannot establish.
set -u
RIG="$(cd "$(dirname "$0")" && pwd)"
BIN="$RIG/bin"
mkdir -p "$BIN"

cat > "$BIN/_log" <<'EOL'
#!/bin/bash
# _log TOOL DETAIL -- one ordered line per requested action.
n=$(( $(wc -l < "$RIGLOG/actions.log" 2>/dev/null || echo 0) + 1 ))
printf '%03d %-10s %s\n' "$n" "$1" "$2" >> "$RIGLOG/actions.log"
EOL
chmod +x "$BIN/_log"

# ---- spt.exe stub: THE PRODUCT COMMAND. Its only job is to record that the
# driver asked for it. Whether such a call would elevate is NOT knowable here
# and is not claimed; what is recorded is the verb and whether the opt-out
# variable was present, which is what decides mutation per the product source.
cat > "$RIG/spt-stub.sh" <<'EOS'
#!/bin/bash
"$RIGBIN/_log" SPT "verb=[$*] SPT_INSTALL_NO_FIREWALL=${SPT_INSTALL_NO_FIREWALL-<REMOVED>} SPT_HOME=${SPT_HOME:-<unset>}"
case "${FP_SPT_MODE:-noop}" in
  arm_a_trial)
    printf 'leg=verify-query outcome=completed ms=42\n' >&2
    printf 'LAN admission verified\n'
    exit 0 ;;
  b_setup_reject)
    case "$*" in
      *--bootstrap*)
        if [ -z "${SPT_INSTALL_NO_FIREWALL+x}" ]; then
          printf 'ActiveStore enforcement is NotConfigurable; refusing\n' >&2
          exit 1
        fi ;;
    esac
    printf 'leg=verify-query outcome=completed ms=41\n' >&2
    exit 0 ;;
  *) exit 0 ;;
esac
EOS
chmod +x "$RIG/spt-stub.sh"

cat > "$BIN/cargo" <<'EOC'
#!/bin/bash
"$RIGBIN/_log" CARGO "argv=[$*] cwd=$PWD"
case "$*" in
  *debug-keygen*)       printf 'staged --key-id fp-debug-2026 --public-key deadbeefcafe\n'; exit 0 ;;
  *debug-rollout*)      printf 'DEBUG_ROLLOUT_STAGED version=1\n'; exit 0 ;;
  *debug-mark-applied*) printf 'DEBUG_MARKED_APPLIED version=1\n'; exit 0 ;;
esac
exit 0
EOC
chmod +x "$BIN/cargo"

cat > "$BIN/gh" <<'EOG'
#!/bin/bash
"$RIGBIN/_log" GH "argv=[$*]"
printf '[]\n'
EOG
chmod +x "$BIN/gh"

cat > "$BIN/python" <<'EOP'
#!/bin/bash
"$RIGBIN/_log" PYTHON "argv=[$*]"
printf 'PRECHECK Named-Rules=1 PersistentStore=0 Get-NetIPAddress=1 ActiveStore=2\n'
exit 0
EOP
chmod +x "$BIN/python"

cat > "$BIN/powershell.exe" <<'EOW'
#!/bin/bash
"$RIGBIN/_log" PWSH_ENC "argv=[$*]"
printf '{}\n'
EOW
chmod +x "$BIN/powershell.exe"

cat > "$BIN/pwsh" <<'EOZ'
#!/bin/bash
"$RIGBIN/_log" PWSH "argv=[$*]"
file=""; tag=""; outdir=""
while [ $# -gt 0 ]; do
  case "$1" in
    -File)    file="$2"; shift 2 ;;
    -Tag)     tag="$2";  shift 2 ;;
    -OutDir)  outdir="$2"; shift 2 ;;
    -Command) printf 'FREE_GIB=%s USED_GIB=1000.00\n' "${FP_FREE_GIB:-124.00}"; exit 0 ;;
    *) shift ;;
  esac
done
case "$(basename "$file")" in
  runner-census.ps1) printf 'RUNNER_WORKER=ABSENT\n'; exit 0 ;;
  cpubracket.ps1)    printf 'bracket tag=%s load=0.10\n' "$tag"; exit 0 ;;
  census.ps1)
      printf 'tag=%s ctl_5470=1 ctl_sptexe=1 valid=YES subj_group=%s subj_29470=%s\n' \
        "$tag" "${FP_CENSUS_GROUP:-0}" "${FP_CENSUS_29470:-0}"
      exit 0 ;;
  preserve5470.ps1)
      printf 'Name=spt-lan Enabled=True Direction=Inbound Action=Allow Program=C:/spt/spt.exe\nListener pid=1234 path=C:/spt/spt.exe start=2026-09-12T00:00:00Z\n' \
        > "$outdir/preserve5470-$tag.txt"
      exit 0 ;;
esac
exit 0
EOZ
chmod +x "$BIN/pwsh"

echo "stubs built: $BIN (+ $RIG/spt-stub.sh)"