// Command imagebuild refuses any manifest but modules/buildah providing the rootless-image-build provision
// (novox/hq ADR 0487 §3, issue 1704): the image builder's tool is buildah alone, and docker, whose daemon holds
// the machine's root, never stands in for it. A second provider would let a node compose mesh-build-image over
// something that is not the rootless builder it was designed against.
//
//	go run . <catalogue root>
//
// Exits 1 on a finding.
package main

import (
	"encoding/json"
	"fmt"
	"os"
	"path/filepath"
	"sort"
)

// Provision is the provision only Provider may provide.
const Provision = "rootless-image-build"

// Provider is the one module allowed to provide it.
const Provider = "buildah"

// Finding is one manifest refused: a module other than buildah providing the provision.
type Finding struct {
	Module string
}

// Check reads every manifest under root/modules and answers which ones it refuses, and whether buildah provides.
func Check(root string) ([]Finding, error) {
	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
	if err != nil {
		return nil, err
	}
	sort.Strings(manifests)
	var out []Finding
	provided := false
	for _, path := range manifests {
		raw, err := os.ReadFile(path)
		if err != nil {
			return nil, err
		}
		var m struct {
			Module   string `json:"module"`
			Provides []struct {
				Name string `json:"name"`
			} `json:"provides"`
		}
		if err := json.Unmarshal(raw, &m); err != nil {
			return nil, fmt.Errorf("%s: %w", path, err)
		}
		for _, p := range m.Provides {
			if p.Name != Provision {
				continue
			}
			if m.Module == Provider {
				provided = true
			} else {
				out = append(out, Finding{Module: m.Module})
			}
			break
		}
	}
	if !provided {
		out = append(out, Finding{Module: Provider})
	}
	return out, nil
}

func main() {
	root := "."
	if len(os.Args) > 1 {
		root = os.Args[1]
	}
	found, err := Check(root)
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	for _, f := range found {
		if f.Module == Provider {
			fmt.Printf("%s does not provide %s (novox/hq ADR 0487 §3)\n", Provider, Provision)
			continue
		}
		fmt.Printf("%s provides %s: only %s may, and docker never (novox/hq ADR 0487 §3)\n", f.Module, Provision, Provider)
	}
	if len(found) > 0 {
		os.Exit(1)
	}
	fmt.Println("imagebuild: rootless-image-build is provided only by buildah")
}