#!/usr/bin/env bash
# Run as root on a systemd host; uses only synthetic credentials.
set -euo pipefail
test_dir=$(mktemp -d /tmp/dex-ldap-env-test.XXXXXX)
trap 'rm -f "$test_dir/password" "$test_dir/environment" "$test_dir/actual"; rmdir "$test_dir"' EXIT
script_dir=$(cd -- "$(dirname -- "$0")" && pwd)

for password in 'simple' '  spaces "quotes" \slash $dollar `backtick` #hash ;semi  ' $'line one\nline two'; do
  printf '%s' "$password" > "$test_dir/password"
  bash "$script_dir/dex-ldap-env.sh" "$test_dir/password" "$test_dir/environment"
  test "$(stat -c %a "$test_dir/environment")" = 600
  systemd-run --quiet --wait --pipe --collect \
    --property="EnvironmentFile=$test_dir/environment" \
    "$(command -v bash)" -c 'printf "%s" "$LDAP_BIND_PW"' > "$test_dir/actual"
  cmp "$test_dir/password" "$test_dir/actual"
done
printf 'Dex LDAP EnvironmentFile round-trip: 3 cases passed\n'