#!/usr/bin/env bash
# Disposable synthetic-only PG/MinIO. No published ports or access to application networks.
set -euo pipefail
root=$(cd "$(dirname "$0")/.." && pwd)
deps=/tmp/ped-ai-release-deps-20260906/node_modules
run=ped-image-check-$$
secrets=$(mktemp -d)
chmod 700 "$secrets"
cleanup() { docker rm -f "$run-pg" "$run-s3" >/dev/null 2>&1 || true; docker network rm "$run" >/dev/null 2>&1 || true; rm -rf "$secrets"; }
trap cleanup EXIT
# These are disposable test credentials, not production secrets/identities.
printf '%s' 'synthetic-image-app' > "$secrets/access"
printf '%s' 'synthetic-app-secret-only' > "$secrets/secret"
chmod 600 "$secrets/"*
docker network create --internal "$run" >/dev/null
docker run -d --name "$run-pg" --network "$run" --network-alias test-pg --memory 256m --cpus 1 -e POSTGRES_PASSWORD=synthetic-only -e POSTGRES_DB=image_lane postgres:16 >/dev/null
docker run -d --name "$run-s3" --network "$run" --network-alias test-s3 --tmpfs /data:mode=1777 --memory 512m --cpus 1 -e GOMEMLIMIT=256MiB -e MINIO_ROOT_USER=synthetic-root -e MINIO_ROOT_PASSWORD=synthetic-root-only ped-ai-minio:9e49d5e7a648f-go1.26.1 server /data >/dev/null
for i in $(seq 1 30); do if docker exec "$run-pg" pg_isready -U postgres -d image_lane >/dev/null; then break; fi; sleep 1; done
cat > "$secrets/policy.json" <<'JSON'
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:ListBucket","s3:GetBucketLocation"],"Resource":["arn:aws:s3:::generated-images"]},{"Effect":"Allow","Action":["s3:PutObject","s3:GetObject","s3:DeleteObject"],"Resource":["arn:aws:s3:::generated-images/*"]}]}
JSON
docker run --rm --network "$run" --memory 512m --cpus 1 -e GOMEMLIMIT=256MiB -v "$secrets/policy.json:/policy.json:ro" --entrypoint /bin/sh minio/mc:RELEASE.2025-04-16T18-13-26Z -c '
  set -e
  for i in $(seq 1 30); do mc alias set fixture http://test-s3:9000 synthetic-root synthetic-root-only >/dev/null 2>&1 && break; sleep 1; done
  for i in $(seq 1 30); do mc ready fixture >/dev/null 2>&1 && break; sleep 1; done
  mc mb --ignore-existing fixture/generated-images >/dev/null
  mc admin policy create fixture images /policy.json >/dev/null
  mc admin user add fixture synthetic-image-app synthetic-app-secret-only >/dev/null
  mc admin policy attach fixture images --user synthetic-image-app >/dev/null
'
docker run --rm --network "$run" --memory 768m --cpus 2 -v "$root:$root:ro" -w "$root" -v "$deps:$deps:ro" -v "$secrets:/test-secrets:ro" \
  -e NODE_PATH="$deps" -e GENERATED_IMAGES_TEST_DB=postgresql://postgres:synthetic-only@test-pg:5432/image_lane \
  -e DATA_ENCRYPTION_KEY=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa \
  -e GENERATED_IMAGES_S3_ENDPOINT=http://test-s3:9000 -e GENERATED_IMAGES_S3_ACCESS_KEY_FILE=/test-secrets/access -e GENERATED_IMAGES_S3_SECRET_KEY_FILE=/test-secrets/secret \
  node:24-bookworm node --test test/generated-images.integration.js