#!/bin/bash
# Checks parts/hidepid.sh on a temp systemd folder with pretend sudo, systemctl, mount and group
# commands: the boot service it writes (the group's number and not its name, once however often
# it runs, enabled), the drop-ins that keep logind and polkit seeing everyone (polkit's even
# before it is installed), /proc remounted now, and --remove putting it all back. (Tried for
# real: systemd makes no mount unit from an /etc/fstab line for /proc, so the part must not rely
# on one.) Nothing of this computer is changed. Run by test.sh, or:
#   bash tools/test-hidepid.sh
# shellcheck disable=SC2016  # the inner shells expand their own variables
HERE=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
T=$(mktemp -d) || { echo "  FAIL  couldn't make a temp folder (is /tmp full?)"; exit 1; }
trap 'rm -rf "$T"' EXIT
fails=0
check() { # DESCRIPTION CONDITION-COMMAND...
    local what=$1
    shift
    if "$@" >/dev/null 2>&1; then printf '  ok    %s\n' "$what"; else printf '  FAIL  %s\n' "$what"; fails=$((fails + 1)); fi
}
not() { ! "$@"; }

R=$T/r
mkdir -p "$R/parts" "$T/bin" "$T/sysd"
sed 's|^export PATH=.*|export PATH="$HP_TEST_PATH"|' "$HERE/lib.sh" >"$R/lib.sh"
grep -q HP_TEST_PATH "$R/lib.sh" || { echo "  FAIL  lib.sh's PATH line wasn't found"; exit 1; }
for f in packages.sh pins.sh lib data bin docs; do ln -s "$HERE/$f" "$R/$f"; done
sed -e "s|/etc/systemd/system|$T/sysd|g" "$HERE/parts/hidepid.sh" >"$R/parts/hidepid.sh"

# pretend programs: every call is written to a log
cat >"$T/bin/sudo" <<'X'
#!/bin/bash
while [ "${1#-}" != "$1" ]; do shift; done
[ $# -gt 0 ] || exit 0
if [ "$1" = install ]; then
    a=()
    while [ $# -gt 0 ]; do case $1 in -o | -g) shift 2 ;; *) a+=("$1"); shift ;; esac; done
    set -- "${a[@]}"
fi
exec "$@"
X
cat >"$T/bin/systemctl" <<'X'
#!/bin/bash
echo "systemctl $*" >>"$HP_LOG"
case $1 in
    cat) [ "$2" != "polkit.service" ] || [ -z "${HP_NO_POLKIT:-}" ]; exit $? ;;
    is-active) exit 0 ;;
esac
exit 0
X
cat >"$T/bin/mount" <<'X'
#!/bin/bash
echo "mount $*" >>"$HP_LOG"
X
cat >"$T/bin/getent" <<'X'
#!/bin/bash
[ "$1" = group ] || exit 2
if [ -e "$HP_STATE/group" ]; then echo "wren-proc:x:998:"; else exit 2; fi
X
cat >"$T/bin/groupadd" <<'X'
#!/bin/bash
echo "groupadd $*" >>"$HP_LOG"
touch "$HP_STATE/group"
X
cat >"$T/bin/groupdel" <<'X'
#!/bin/bash
echo "groupdel $*" >>"$HP_LOG"
rm -f "$HP_STATE/group"
X
chmod +x "$T"/bin/*
mkdir -p "$T/state"
run() { # [ARGS]: the part, as a normal user
    HP_TEST_PATH="$T/bin:$PATH" HP_LOG=$T/log HP_STATE=$T/state HP_NO_POLKIT=${HP_NO_POLKIT:-} \
        bash "$R/parts/hidepid.sh" "$@" </dev/null
}

HP_NO_POLKIT=1 run >/dev/null 2>&1
check "the group is made" grep -q '^groupadd --system wren-proc' "$T/log"
check "a service remounts /proc at every boot, so that others' programs are invisible" grep -qx 'ExecStart=/usr/bin/mount -o remount,hidepid=invisible,gid=998 /proc' "$T/sysd/wren-hidepid.service"
check "...by the group's number" not grep -q 'gid=wren-proc' "$T/sysd/wren-hidepid.service"
check "...early, before logind and before anything logs in" grep -qx 'Before=sysinit.target systemd-logind.service' "$T/sysd/wren-hidepid.service"
check "...and is enabled" grep -qx 'systemctl enable wren-hidepid.service' "$T/log"
check "nothing is written to /etc/fstab: systemd ignores a line for /proc" not grep -qE '^[^#]*(FSTAB|fstab)' "$HERE/parts/hidepid.sh"
check "...but not now: a running desktop would lose its seat (logind restarted under sway: tried by the owner)" not grep -q '^mount ' "$T/log"
check "...and nothing is restarted now either" not grep -q 'restart' "$T/log"
check "systemd-logind keeps the group, so it still sees every session's programs" grep -qx 'SupplementaryGroups=wren-proc' "$T/sysd/systemd-logind.service.d/wren-hidepid.conf"
# (on a fresh install polkit comes after this part, from network-manager.sh and usb.sh: skipped
# then, polkit couldn't see your programs from the next boot; the ultra review found it)
check "polkit gets the group even before it is installed, ready for when it comes" \
    grep -qx 'SupplementaryGroups=wren-proc' "$T/sysd/polkit.service.d/wren-hidepid.conf"
: >"$T/log"
run >/dev/null 2>&1
check "run again, the service is still one" test "$(grep -c '^ExecStart' "$T/sysd/wren-hidepid.service")" -eq 1
check "...the group is not made twice" not grep -q '^groupadd' "$T/log"
check "polkit keeps the group too, where it is installed" grep -qx 'SupplementaryGroups=wren-proc' "$T/sysd/polkit.service.d/wren-hidepid.conf"

: >"$T/log"
run --remove >/dev/null 2>&1
check "--remove: the service is disabled and gone" bash -c 'grep -qx "systemctl disable wren-hidepid.service" "$1" && [ ! -e "$2/wren-hidepid.service" ]' _ "$T/log" "$T/sysd"
check "...the drop-ins are gone" bash -c '! ls "$1"/*/wren-hidepid.conf' _ "$T/sysd"
check "...everyone sees every program again, now" grep -qx 'mount -o remount,hidepid=off,gid=0 /proc' "$T/log"
check "...and the group is deleted" grep -q '^groupdel wren-proc' "$T/log"
check "it is one of the base parts" grep -qE '(^|[ (])hidepid([ )]|$)' "$HERE/packages.sh"
check "it is passed by shellcheck" bash -c 'command -v shellcheck >/dev/null || exit 0; shellcheck -x "$1"' _ "$HERE/parts/hidepid.sh"

[ "$fails" -eq 0 ]