#!/usr/bin/env bash
# Shared helpers. Source this; do not run it.
#
# run_case <jdk-home> <recording.jfr> <extra JVM flags...>
#   Runs the Workload with the SAME planted secrets every time, under a clean
#   environment (env -i), so only the fake secrets below can ever end up in a
#   recording. Your real shell environment is never passed through.
HERE="$(cd "$(dirname "$0")/.." && pwd)"
BUILD="$HERE/build"

# The planted secrets. Each one has a name that tells you where it hides.
SECRETS=(LEAK-ENV-TOKEN-1 LEAK-PROP-PASSWORD-2 LEAK-ARG-DBPASSWORD-3 LEAK-URL-PW-4
         LEAK-ENV-CONN-5 LEAK-PROP-DBPASS-6 LEAK-ARG-DBPASS-7)

compile() { # <jdk-home>
  mkdir -p "$BUILD"
  "$1/bin/javac" --release 21 -d "$BUILD" "$HERE/src/Workload.java" "$HERE/src/Scan.java" 2>&1 | grep -v '^Picked up' || true
}

run_jvm() { # <jdk-home> [flags...]   (no recording flag: caller decides)
  local jdk="$1"; shift
  env -i PATH=/usr/bin:/bin HOME=/nonexistent \
      ACCESS_TOKEN=LEAK-ENV-TOKEN-1 DB_CONN=LEAK-ENV-CONN-5 DEPLOY_REGION=eu-west-1 \
    "$jdk/bin/java" "$@" \
      -Xmx256m \
      -Djavax.net.ssl.keyStorePassword=LEAK-PROP-PASSWORD-2 \
      -Ddb-pass=LEAK-PROP-DBPASS-6 \
      -Dapp.region=mumbai \
      -cp "$BUILD" Workload \
      --dbpassword LEAK-ARG-DBPASSWORD-3 \
      --db-pass LEAK-ARG-DBPASS-7 \
      https://john:LEAK-URL-PW-4@example.com/login \
      --verbose
}

run_case() { # <jdk-home> <jfr-out> [flags...]   (recording from JVM start)
  local jdk="$1" out="$2"; shift 2
  run_jvm "$jdk" -XX:StartFlightRecording:filename="$out" "$@"
}

scan() { "$1/bin/java" -cp "$BUILD" Scan "$2" "${SECRETS[@]}" 2>&1 | grep -v '^Picked up'; }

print_events() { # <jdk-home> <jfr>
  "$1/bin/jfr" print --events InitialSystemProperty,JVMInformation,InitialEnvironmentVariable "$2" 2>&1 | grep -v '^Picked up'
}