stands-engine

#!/usr/bin/env bash
set -euo pipefail

usage() {
    cat <<'EOF'
Usage: ./stands-engine [options] <validate|create|destroy> <manifest>

Options:
  --runtime <docker|podman>  Container runtime (auto-detected by default)
  --image <reference>        OCI image (default: stands-engine:local)
  --env-file <path>          Environment file passed to the container (repeatable)
  --resource <name=path>     Read-only directory for hook assets (repeatable)
  -h, --help                 Show this help

Environment:
  STANDS_ENGINE_IMAGE        Default image reference
  CONTAINER_RUNTIME          Default container runtime
EOF
}

runtime="${CONTAINER_RUNTIME:-}"
image="${STANDS_ENGINE_IMAGE:-stands-engine:local}"
env_files=()
env_file_count=0
operation=""
manifest=""
resource_names=()
resource_paths=()
resource_count=0

while (($#)); do
    case "$1" in
        --runtime)
            runtime="${2:?--runtime requires a value}"
            shift 2
            ;;
        --image)
            image="${2:?--image requires a value}"
            shift 2
            ;;
        --env-file)
            env_files+=("${2:?--env-file requires a value}")
            env_file_count=$((env_file_count + 1))
            shift 2
            ;;
        --resource)
            resource_spec="${2:?--resource requires NAME=PATH}"
            resource_name="${resource_spec%%=*}"
            resource_path="${resource_spec#*=}"
            if [[ "${resource_spec}" != *=* || ! "${resource_name}" =~ ^[A-Za-z][A-Za-z0-9_-]*$ || -z "${resource_path}" ]]; then
                echo "Invalid resource '${resource_spec}'; expected NAME=PATH with a valid name." >&2
                exit 2
            fi
            for ((index=0; index<resource_count; index++)); do
                if [[ "${resource_names[$index]}" == "${resource_name}" ]]; then
                    echo "Resource '${resource_name}' was specified more than once." >&2
                    exit 2
                fi
            done
            if [[ ! -d "${resource_path}" ]]; then
                echo "Resource '${resource_name}' is not a directory: ${resource_path}" >&2
                exit 1
            fi
            resolved_resource_path="$(cd "${resource_path}" && pwd -P)"
            resource_names+=("${resource_name}")
            resource_paths+=("${resolved_resource_path}")
            resource_count=$((resource_count + 1))
            shift 2
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        validate|create|destroy)
            if [[ -n "${operation}" ]]; then
                echo "Operation was specified more than once." >&2
                usage >&2
                exit 2
            fi
            operation="$1"
            shift
            ;;
        *)
            if [[ -z "${manifest}" ]]; then
                manifest="$1"
                shift
            else
                echo "Unexpected argument: $1" >&2
                usage >&2
                exit 2
            fi
            ;;
    esac
done

if [[ -z "${operation}" || -z "${manifest}" ]]; then
    usage >&2
    exit 2
fi

if [[ -z "${runtime}" ]]; then
    if command -v podman >/dev/null 2>&1; then
        runtime="podman"
    elif command -v docker >/dev/null 2>&1; then
        runtime="docker"
    else
        echo "Neither podman nor docker was found in PATH." >&2
        exit 1
    fi
fi

if [[ "${runtime}" != "docker" && "${runtime}" != "podman" ]]; then
    echo "Unsupported container runtime: ${runtime}" >&2
    exit 2
fi

if ! command -v "${runtime}" >/dev/null 2>&1; then
    echo "Container runtime '${runtime}' was not found in PATH." >&2
    exit 1
fi

if [[ ! -f "${manifest}" ]]; then
    echo "Manifest does not exist: ${manifest}" >&2
    exit 1
fi

cwd="$(pwd -P)"
manifest_dir="$(cd "$(dirname "${manifest}")" && pwd -P)"
manifest_name="$(basename "${manifest}")"

case "${manifest_dir}" in
    "${cwd}")
        workspace="${cwd}"
        container_manifest="/workspace/${manifest_name}"
        ;;
    "${cwd}"/*)
        workspace="${cwd}"
        relative_dir="${manifest_dir#"${cwd}"/}"
        container_manifest="/workspace/${relative_dir}/${manifest_name}"
        ;;
    *)
        workspace="${manifest_dir}"
        container_manifest="/workspace/${manifest_name}"
        ;;
esac

run_args=(run --rm)
if [[ -t 0 && -t 1 ]]; then
    run_args+=(-it)
fi

if [[ "$(uname -s)" == "Linux" ]]; then
    if [[ "${runtime}" == "podman" ]]; then
        run_args+=(--user 0:0)
    else
        run_args+=(--user "$(id -u):$(id -g)")
    fi
fi

for ((index=0; index<env_file_count; index++)); do
    env_file="${env_files[$index]}"
    if [[ ! -f "${env_file}" ]]; then
        echo "Environment file does not exist: ${env_file}" >&2
        exit 1
    fi
    env_file_dir="$(cd "$(dirname "${env_file}")" && pwd -P)"
    run_args+=(--env-file "${env_file_dir}/$(basename "${env_file}")")
done

workspace_mount="${workspace}:/workspace:ro"
if [[ "${runtime}" == "podman" && "$(uname -s)" == "Linux" ]]; then
    workspace_mount="${workspace_mount},Z"
fi

run_args+=(--volume "${workspace_mount}")

if [[ "${operation}" == "validate" ]]; then
    run_args+=(
        --env STAND__PATH_TO_KEY=/tmp/stands-engine-validation/id_ed25519
        --env STAND__PATH_TO_CONFIGSET=/tmp/stands-engine-validation/configsets
        --env OUTPUT__FILE_PATH=/tmp/stands-engine-validation/output
    )
else
    data_dir="${cwd}/.stands-engine"
    mkdir -p "${data_dir}/keys" "${data_dir}/configsets" "${data_dir}/output"
    data_mount="${data_dir}:/data"
    if [[ "${runtime}" == "podman" && "$(uname -s)" == "Linux" ]]; then
        data_mount="${data_mount}:Z"
    fi
    run_args+=(
        --volume "${data_mount}"
        --env STAND__PATH_TO_KEY=/data/keys/id_ed25519
        --env STAND__PATH_TO_CONFIGSET=/data/configsets
        --env OUTPUT__FILE_PATH=/data/output
    )
fi

for ((index=0; index<resource_count; index++)); do
    resource_name="${resource_names[$index]}"
    resource_mount="${resource_paths[$index]}:/resources/${resource_name}:ro"
    if [[ "${runtime}" == "podman" && "$(uname -s)" == "Linux" ]]; then
        resource_mount="${resource_mount},Z"
    fi
    run_args+=(--volume "${resource_mount}")
done

run_args+=("${image}")
for ((index=0; index<resource_count; index++)); do
    resource_name="${resource_names[$index]}"
    run_args+=(--resource "${resource_name}=/resources/${resource_name}")
done
run_args+=("${operation}" "${container_manifest}")

exec "${runtime}" "${run_args[@]}"