#!/usr/bin/expect -f

if {$argc != 2} {
    puts stderr "usage: admin.exp RUNNER DISK"
    exit 2
}
set runner [file normalize [lindex $argv 0]]
set disk [file normalize [lindex $argv 1]]
set timeout 180
set acceptance_name "admin"
source [file join [file dirname [info script]] harness.exp]

acceptance_log
set env(MOUSE_BOOT_MODE) disk
set env(MOUSE_DISK_IMAGE) $disk
set env(MOUSE_NETWORK) 0
set env(MOUSE_GRAPHICAL) 0
set env(MOUSE_KERNEL_ARGS) "console=$env(MOUSE_CONSOLE) root=PARTUUID=4d4f5553-4500-4000-8000-000000000002 rootfstype=btrfs rw rootwait init=/sbin/cheesed panic=-1 quiet loglevel=3"
spawn -noecho $runner

await_exact "mousehole login: " "the administrator login prompt"
sendline {mouse}
await_exact "Password: " "the administrator password prompt"
sendline {cheddar}
await_exact "mouse:~> " "the administrator shell"
sendline {sh -c 'test -u /usr/bin/doas && test "$(stat -f "%u %g" /usr/bin/doas)" = "0 0"'; echo DOAS_METADATA_$status}
await_exact "DOAS_METADATA_0\r" "the installed doas metadata"
await_exact "mouse:~> " "the prompt after the doas metadata check"
sendline {sh -c '! findmnt -n -o OPTIONS / | tr , "\n" | grep -qx nosuid'; echo ROOT_SUID_$status}
await_exact "ROOT_SUID_0\r" "a root mount that permits setuid execution"
await_exact "mouse:~> " "the prompt after the root mount check"
sendline {grep -Eq '^NoNewPrivs:[[:space:]]+0$' /proc/self/status; echo NO_NEW_PRIVS_$status}
await_exact "NO_NEW_PRIVS_0\r" "the login process privilege state"
await_exact "mouse:~> " "the prompt after the privilege-state check"
sendline {test -c /dev/dri/card0; echo GRAPHICS_$status}
await_exact "GRAPHICS_0\r" "the virtio GPU DRM device"
await_exact "mouse:~> " "the prompt after the graphics-device check"
sendline {doas id}
await_exact "doas (mouse@mousehole) password: " "the doas password prompt"
sendline {cheddar}
await_exact "uid=0(root) gid=0(root) groups=0(root)\r" "authenticated doas elevation"
await_exact "mouse:~> " "the administrator prompt after doas"
sendline {exit}
await_exact "mousehole login: " "the respawned login prompt"
sendline {mouse}
await_exact "Password: " "the administrator password prompt after respawn"
sendline {cheddar}
await_exact "mouse:~> " "the administrator shell after login respawn"
sendline {doas poweroff}
await_exact "doas (mouse@mousehole) password: " "the doas password prompt for poweroff"
sendline {cheddar}
await_exact "cheesed: received poweroff request" "the privileged poweroff request"
await_exact "cheesed: root filesystem remounted read-only" "the read-only root remount"
await_clean_exit "poweroff"

puts "administrator and graphical-console prerequisites passed"