#!/usr/bin/env bash
# Run ONLY from the isolated review candidate. No .env files or published DB ports.
set -euo pipefail
review_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
: "${MINEROPS_REVIEW_BACKEND_IMAGE:?Set an existing Python backend image with requirements installed}"
docker image inspect "$MINEROPS_REVIEW_BACKEND_IMAGE" >/dev/null
review_id="minerops-discovery-review-$$-$RANDOM"
review_network="$review_id-network"
review_db="$review_id-postgres"
cleanup() {
    docker rm -f "$review_db" >/dev/null 2>&1 || true
    docker network rm "$review_network" >/dev/null 2>&1 || true
}
trap cleanup EXIT
docker network create --internal "$review_network" >/dev/null
docker run -d --name "$review_db" --network "$review_network" --network-alias postgres \
    --tmpfs /var/lib/postgresql/data \
    -e POSTGRES_DB=discovery_review -e POSTGRES_USER=reviewer \
    -e POSTGRES_PASSWORD=disposable-review-only postgres:16-alpine >/dev/null
review_ready=0
for _ in $(seq 1 40); do
    if docker exec "$review_db" pg_isready -U reviewer -d discovery_review >/dev/null 2>&1; then review_ready=1; break; fi
    sleep 0.5
done
[[ "$review_ready" == 1 ]]
run_backend() {
    docker run --rm --network "$review_network" -v "$review_root:/review:ro" \
        -w /review/backend -e PYTHONDONTWRITEBYTECODE=1 -e PYTHONPATH=/review/backend \
        -e POSTGRES_HOST=postgres -e POSTGRES_DB=discovery_review -e POSTGRES_USER=reviewer \
        -e POSTGRES_PASSWORD=disposable-review-only -e JWT_SECRET_KEY=disposable-review-only \
        -e MINEROPS_DISCOVERY_DISPOSABLE=1 -e MINEROPS_HUB_MODE=true \
        -e SCHEDULED_SCAN_ENABLED=false -e MINEROPS_WINDOWS_AGENT_SOURCE=/review/agents/windows \
        "$MINEROPS_REVIEW_BACKEND_IMAGE" "$@"
}
run_backend alembic upgrade head
run_backend python -m unittest -v tests.test_discovery_security_postgres \
    tests.test_agent_discovery_isolation_postgres \
    tests.test_legacy_inventory_security_postgres
# Browser and PowerShell suites use their own intercepted/loopback transports.
# See docs/operations/BLOCKER_1_DISCOVERY_REVIEW.txt for exact commands and baseline exceptions.