#!/usr/bin/env bash
require_cmd git
require_cmd jq
export MISE_HISTORY_NOTIFY=false
origin="$PWD/origin.git"
git init -q --bare -b main "$origin"
mkdir -p ~/private/nested
echo private >~/private/nested/config
chmod 700 ~/private
chmod 750 ~/private/nested
assert_succeed 'mise bootstrap dotfiles track ~/private'
# A tracked file inside a private directory records that directory's mode,
# not home's, even though only the file is enrolled.
mkdir -p ~/.claude
echo '{}' >~/.claude/settings.json
chmod 700 ~ ~/.claude
assert_succeed 'mise bootstrap dotfiles track ~/.claude/settings.json'
repo="$MISE_STATE_DIR/history/repo.git"
assert "git --git-dir='$repo' show HEAD:.mise-history/manifest.json | jq -r '.permissions[\"home/.claude\"]'" 448
assert "git --git-dir='$repo' show HEAD:.mise-history/manifest.json | jq -r '.permissions[\"home\"]'" null
# A file that lives only in a variant stream still records its private
# parent once, without a variant, and the tree holds it under the stream.
if [[ "$(uname)" == Darwin ]]; then
  stream=macos
else
  stream=linux
fi
mkdir -p ~/.variant-private
echo '{}' >~/.variant-private/settings.json
chmod 700 ~/.variant-private
assert_succeed "mise bootstrap dotfiles track ~/.variant-private/settings.json --os $stream"
assert "git --git-dir='$repo' show HEAD:.mise-history/manifest.json | jq -r '.permissions[\"home/.variant-private\"]'" 448
assert "git --git-dir='$repo' show HEAD:.mise-history/manifest.json | jq -r '.permissions[\"home@$stream/.variant-private\"]'" null
assert_succeed "git --git-dir='$repo' cat-file -e HEAD:home@$stream/.variant-private/settings.json"
assert_succeed "mise bootstrap dotfiles origin set file://$origin --sync manual --yes"
second="$(dirname "$HOME")/directory-permissions-b"
mkdir -p "$second"
chmod 755 "$second"
b() {
  (
    cd "$second" || exit
    env HOME="$second" XDG_CONFIG_HOME="$second/.config" MISE_CONFIG_DIR="$second/.config/mise" \
      MISE_STATE_DIR="$second/.local/state/mise" MISE_DATA_DIR="$second/.local/share/mise" \
      MISE_CACHE_DIR="$second/.cache/mise" MISE_TRUSTED_CONFIG_PATHS="$second" mise "$@"
  )
}
export second
export -f b
if [[ "$(uname)" == Darwin ]]; then
  mode_of='stat -f %Lp'
else
  mode_of='stat -c %a'
fi
assert_succeed "b bootstrap --adopt file://$origin --yes"
assert "$mode_of $second/private" 700
assert "$mode_of $second/private/nested" 750
# The fresh machine recreates the file's parent private; its home is its own.
assert "$mode_of $second/.claude" 700
assert "cat $second/.claude/settings.json" '{}'
assert "$mode_of $second/.variant-private" 700
assert "cat $second/.variant-private/settings.json" '{}'
assert "$mode_of $second" 755
chmod 750 ~/private
chmod 755 ~/.claude
assert_succeed 'mise bootstrap dotfiles save'
assert "git --git-dir='$repo' show HEAD:.mise-history/manifest.json | jq -r '.permissions[\"home/.claude\"]'" null
assert_succeed 'mise bootstrap dotfiles sync'
assert_succeed 'b bootstrap dotfiles sync'
assert_succeed 'b bootstrap dotfiles pull --yes'
assert "$mode_of $second/private" 750
assert "$mode_of $second/.claude" 755
chmod 700 ~/private/nested
assert_succeed 'mise bootstrap dotfiles save'
assert_succeed 'mise bootstrap dotfiles sync'
# Fetching continues, but an unsaved chmod must not be overwritten.
assert_succeed 'b bootstrap dotfiles sync --fetch-only'
chmod 711 "$second/private/nested"
assert_fail 'b bootstrap dotfiles pull --yes' 'unsaved directory permission'
assert "$mode_of $second/private/nested" 711
assert "cat $second/private/nested/config" private
