#!/bin/bash
# Verify delete lifecycle uses proper transaction isolation

rg -n -C5 'deleted_time|Finalizing' pkg/dao/ pkg/services/ --type=go | rg -C3 'Begin|Transaction|Lock'

# Check for generation increment atomicity
ast-grep --pattern $'func $_(ctx context.Context, id string) $_ {
  $$$
  deleted_time
  $$$
  generation
  $$$
}'

#!/bin/bash
set -euo pipefail

# Show docs snippet around the referenced lines
echo "---- docs/database.md (around lines 50-90) ----"
nl -ba docs/database.md | sed -n '50,95p'

# Search for referenced lifecycle terms in Go
echo "---- rg lifecycle terms (case-sensitive) ----"
rg -n --hidden --no-ignore-vcs "force-delete|Finalizing|Finalized|deleted_time|deleted_by|generation" . -S -g'*.go' || true

echo "---- rg lifecycle terms in SQL/migrations/docs ----"
rg -n --hidden --no-ignore-vcs "force-delete|Finalizing|Finalized|deleted_time|deleted_by|generation" . -S -g'*.sql' -g'*.md' -g'*.go' -g'*.yaml' -g'*.yml' || true

echo "---- rg delete policies text (restrict/cascade) ----"
rg -n --hidden --no-ignore-vcs "restrict|cascade|force-delete|POST /force-delete|/force-delete" . -S -g'*.go' -g'*.md' || true

#!/bin/bash
set -euo pipefail

# Locate where DELETE lifecycle is implemented by searching for status transitions / queries
echo "---- rg for 'Finalize' / 'hard delete' ----"
rg -n --hidden --no-ignore-vcs "hard-?deleted|HardDeleted|Finalized|Finalize|force delete|force-delete" . -S -g'*.go' || true

echo "---- rg for 'deleted_time' exact column usage ----"
rg -n --hidden --no-ignore-vcs "deleted_time" . -S -g'*.go' -g'*.sql' -g'*.yaml' -g'*.yml' || true

echo "---- rg for 'generation' updates related to deletes ----"
rg -n --hidden --no-ignore-vcs "generation.*(deleted|delete|finaliz)" . -S -g'*.go' || true

echo "---- list likely DAO/service directories ----"
ls -la
find . -maxdepth 3 -type d \( -name 'dao' -o -name 'service*' -o -name 'pkg' \) 2>/dev/null | head

#!/bin/bash
set -euo pipefail

echo "---- docs/database.md (around lines 50-95) ----"
nl -ba docs/database.md | sed -n '50,95p'

echo "---- rg lifecycle terms in Go (case-sensitive) ----"
rg -n --hidden --no-ignore-vcs "force-delete|Finalizing|Finalized|deleted_time|deleted_by|generation" . -S -g'*.go' || true

echo "---- rg lifecycle terms in SQL/migrations/docs ----"
rg -n --hidden --no-ignore-vcs "force-delete|Finalizing|Finalized|deleted_time|deleted_by|generation" . -S -g'*.sql' -g'*.md' -g'*.yaml' -g'*.yml' -g'*.go' || true

echo "---- rg delete policy text ----"
rg -n --hidden --no-ignore-vcs "restrict|cascade|force-delete|POST /force-delete|/force-delete" . -S -g'*.go' -g'*.md' || true

#!/bin/bash
set -euo pipefail

echo "---- docs/database.md lines 55-90 (with pseudo line numbers) ----"
awk 'NR>=55 && NR<=90 {printf "%d\t%s\n", NR, $0}' docs/database.md

echo "---- rg restrict/cascade/force-delete implementation text in Go/handlers ----"
rg -n --hidden --no-ignore-vcs "(restrict|cascade|force-delete|force delete|enforced recursively|cycle)" . -S -g'*.go' -g'*.md'

echo "---- locate force-delete handlers ----"
rg -n --hidden --no-ignore-vcs "ForceDelete|/force-delete" pkg plugins -S -g'*.go'

echo "---- inspect likely delete policy code locations ----"
rg -n --hidden --no-ignore-vcs "delete policy|policy.*delete|DeletePolicy|cascade|restrict" pkg -S -g'*.go'

echo "---- transaction/locking primitives in relevant services/daos ----"
rg -n --hidden --no-ignore-vcs "(BeginTx|Begin\\(|Commit\\(|Rollback\\(|SELECT FOR UPDATE|FOR UPDATE|Lock\\(|Mutex|lock\\.)" pkg -S -g'*.go'

echo "---- show relevant sections in node_pool.go/cluster.go/aggregation.go/resource.go ----"
# Use sed to avoid huge output; extract around the comment blocks found earlier by rg.
sed -n '520,640p' pkg/services/node_pool.go
sed -n '420,560p' pkg/services/cluster.go
sed -n '220,420p' pkg/services/aggregation.go
sed -n '720,820p' pkg/services/aggregation.go
sed -n '120,200p' pkg/services/resource.go

#!/bin/bash
set -euo pipefail

# Show remainder of deleteResourceTree and checkCanDelete implementation
echo "---- pkg/services/resource.go (Delete + deleteResourceTree continuation) ----"
sed -n '120,260p' pkg/services/resource.go

echo "---- pkg/services/resource.go (checkCanDelete + helpers) ----"
rg -n "func \\(s \\*sqlResourceService\\) checkCanDelete|checkCanDelete\\(" -S pkg/services/resource.go
sed -n '260,430p' pkg/services/resource.go

# Show node_pool.go soft-delete (Delete) and where tryHardDeleteNodePool is called
echo "---- pkg/services/node_pool.go relevant sections ----"
rg -n "func \\(s \\*sqlNodePoolService\\) Delete|MarkDeleted|ForceDelete|tryHardDeleteNodePool|final" pkg/services/node_pool.go -S
sed -n '180,340p' pkg/services/node_pool.go
sed -n '340,620p' pkg/services/node_pool.go

# Show cluster.go soft-delete (Delete) and where tryHardDeleteCluster is called
echo "---- pkg/services/cluster.go relevant sections ----"
rg -n "func \\(s \\*sqlClusterService\\) Delete|MarkDeleted|ForceDelete|tryHardDeleteCluster|tryHardDelete" pkg/services/cluster.go -S
sed -n '90,240p' pkg/services/cluster.go
sed -n '240,560p' pkg/services/cluster.go

# Show registry.ChildrenOf to see if cycle detection exists
echo "---- pkg/registry - ChildrenOf implementation ----"
rg -n "func (ChildrenOf|ChildrenOf\\()" pkg/registry -S
rg -n "ChildrenOf\\(" pkg/registry -S
# Print descriptor registry parts
sed -n '1,220p' pkg/registry/registry.go 2>/dev/null || true
sed -n '1,220p' pkg/registry/descriptor.go
ls -ლა pkg/registry

# Show ForceDelete tests for idempotency / repeated calls
echo "---- ForceDelete tests (look for 'again' or repeated) ----"
rg -n "force-delete.*again|ForceDelete.*again|force delete.*twice|twice" test pkg/services/*_test.go -S || true
rg -n "force-delete" pkg/services/*_test.go test/integration/*_test.go -S | head -n 80

#!/bin/bash
set -euo pipefail
rg -n --hidden --no-ignore-vcs "(Finalizing state|deleted_time.*nil|DeletedTime == nil|deleted_time|DeletedTime != nil|in Finalizing)" pkg/handlers pkg/services -S -g'*.go'

rg -n --hidden --no-ignore-vcs "force-delete" test pkg/handlers pkg/services -S -g'*.go' | head -n 200
rg -n --hidden --no-ignore-vcs "ForceDelete.*(twice|again|already)" test -S -g'*.go'
rg -n --hidden --no-ignore-vcs "not in Finalizing state" pkg -S -g'*.go'

#!/bin/bash
set -euo pipefail

echo "---- pkg/services/resource.go lines 1-120 (find parent.DeletedTime != nil) ----"
sed -n '1,140p' pkg/services/resource.go

echo "---- pkg/handlers create/patch blocks for finalizing (search 409 / Finalizing / deleted_time) ----"
rg -n --hidden --no-ignore-vcs "Finalizing|deleted_time|DeletedTime != nil|not in Finalizing state" pkg/handlers -S -g'*.go'

echo "---- find transaction middleware usage in handlers/services (BeginTx/TransactionMiddleware) ----"
rg -n --hidden --no-ignore-vcs "(transaction|TransactionMiddleware|WithTx|BeginTx|db\\.With|gorm\\.Begin|Begin\\()" pkg/handlers pkg/services pkg/db -S -g'*.go'

echo "---- pkg/services/resource.go checkCanDelete caller context ----"
rg -n --hidden --no-ignore-vcs "checkCanDelete\\(" -S pkg/services/resource.go

#!/bin/bash
set -euo pipefail

echo "---- Where TransactionMiddleware is applied ----"
rg -n --hidden --no-ignore-vcs "TransactionMiddleware\\(" pkg/handlers cmd plugins -S -g'*.go'

echo "---- cluster_nodepools create/patch checks for cluster.DeletedTime ----"
rg -n --hidden --no-ignore-vcs "cluster\\.DeletedTime != nil|DeletedTime != nil.*cluster|marked for deletion" pkg/handlers -S -g'*.go' || true

echo "---- find nodepool create handler and its conflict condition ----"
rg -n --hidden --no-ignore-vcs "NodePool.*Create|CreateNodePool|nodepools.*post" pkg/handlers -S -g'*.go' || true

echo "---- check generic child creation in resource.go already shown; now confirm it maps to 409 in handlers ----"
rg -n --hidden --no-ignore-vcs "marked for deletion" pkg/handlers -S -g'*.go' || true

echo "---- find force-delete idempotency tests (called twice) ----"
rg -n --hidden --no-ignore-vcs "force-delete.*returns|force-deleted.*again|ForceDelete.*again|already.*force-delete" test pkg -S -g'*.go' || true

#!/bin/bash
# Verify config loader validates file permissions and paths

rg -n -C3 'HYPERFLEET_CONFIG|--config' --type=go --glob '!vendor/**' | head -50

# Check for path validation or permission checks
ast-grep --pattern $'func $_(path string) $_ {
  $$$
  os.Stat($$$)
  $$$
}'

#!/bin/bash
set -euo pipefail

# 1) Inspect config loader path resolution + any permission/ownership checks
echo "=== pkg/config/loader.go: resolveAndReadConfigFile ==="
rg -n "resolveAndReadConfigFile|HYPERFLEET_CONFIG|/etc/hyperfleet/config.yaml|configs/config.yaml|ReadInConfig|os\.Stat|UnmarshalExact" pkg/config/loader.go
echo
sed -n '1,220p' pkg/config/loader.go

# 2) Inspect config validation/unmarshal in loader.go (schema enforcement)
echo
echo "=== pkg/config/loader.go: validation calls ==="
rg -n "UnmarshalExact|validator\.Struct|Validate|identity|JWT|TLS|timeout" pkg/config/loader.go

# 3) Force-delete wiring: handler -> service -> auth/RBAC/owner scoping
echo
echo "=== ForceDelete handlers/services (ownership/RBAC) ==="
rg -n "ForceDelete|force-delete" cmd pkg/handlers pkg/services cmd/hyperfleet-api/server/routes.go
echo
# show key snippets if present
for f in cmd/hyperfleet-api/server/routes.go \
         pkg/handlers/cluster.go \
         pkg/handlers/cluster_nodepools.go \
         pkg/services/cluster.go \
         pkg/services/node_pool.go \
         pkg/services/resource.go
do
  if [ -f "$f" ]; then
    echo
    echo "=== $f (relevant lines) ==="
    rg -n "ForceDelete|force-delete|JWTHandler|PublicPaths|CallerIdentityMiddleware|deleteResourceTree|restrict|cascade" "$f" || true
  fi
done

# 4) deleteResourceTree recursion guards
echo
echo "=== pkg/services/resource.go: deleteResourceTree ==="
rg -n "func .*deleteResourceTree|deleteResourceTree|visited|depth|cycle|restrict|cascade" pkg/services/resource.go || true
if [ -f pkg/services/resource.go ]; then
  sed -n '1,260p' pkg/services/resource.go
fi

#!/bin/bash
set -euo pipefail

# Force-delete authN/authZ + middleware wiring
rg -n "PublicPaths|JWTHandler|CallerIdentityMiddleware|force-delete|force delete|ForceDelete" cmd/hyperfleet-api/server/routes.go
echo "----"
sed -n '1,220p' cmd/hyperfleet-api/server/routes.go
echo "----"

rg -n "handleForceDelete|ForceDeleteRequest|jwt|RBAC|authorize|permission|role" pkg/handlers/framework.go pkg/handlers/cluster.go pkg/handlers/cluster_nodepools.go
echo "----"
sed -n '120,230p' pkg/handlers/framework.go
echo "----"
sed -n '140,230p' pkg/handlers/cluster.go
echo "----"
sed -n '120,210p' pkg/handlers/cluster_nodepools.go
echo "----"

# Service-level checks for ForceDelete
rg -n "func \\(s \\*sqlClusterService\\) ForceDelete|func \\(s \\*sqlNodePoolService\\) ForceDelete|DeletedTime|owner|GetBy.*Owner|auth|RBAC|permission" pkg/services/cluster.go pkg/services/node_pool.go
echo "----"
sed -n '450,620p' pkg/services/cluster.go
echo "----"
sed -n '220,360p' pkg/services/node_pool.go
echo "----"

# deleteResourceTree recursion/cycle guards
rg -n "deleteResourceTree\\(|visited|depth|cycle|max depth" pkg/services/resource.go
echo "----"
sed -n '130,260p' pkg/services/resource.go
echo "----"

# Registry descriptor graph validation (cycles, depth limits)
rg -n "cycle|acyclic|topolog|visited|graph|ChildrenOf\\(" pkg/registry
fd . pkg/registry -t f | head -50
for f in $(fd -t f pkg/registry | tr '\n' ' '); do
  # keep output small by only showing likely validation locations
  rg -n "cycle|acyclic|topolog|graph|ChildrenOf\\(" "$f" && echo "---- in $f ----" && break
done

#!/bin/bash
# Check if force-delete handler enforces stricter authz than regular DELETE

rg -n -C5 'force-delete|ForceDelete' --type=go pkg/handlers/ | head -80

#!/bin/bash
set -euo pipefail

# 1) Locate routes/endpoints mentioning force-delete and where authz/middleware is wired.
rg -n --hidden --no-ignore-vcs "force-delete" . || true
rg -n --hidden --no-ignore-vcs "ForceDelete" . || true

# 2) Inspect surrounding handler code for ForceDelete and any normal DELETE methods.
echo "---- cluster.go around ForceDelete and any Delete handlers ----"
sed -n '130,240p' pkg/handlers/cluster.go || true

echo "---- cluster_nodepools.go around ForceDelete and any Delete handlers ----"
sed -n '1,260p' pkg/handlers/cluster_nodepools.go || true

# 3) Inspect framework handler for handleForceDelete / authz-related hooks.
sed -n '1,240p' pkg/handlers/framework.go || true

# 4) README snippet around line ~122 (as referenced by review comment)
ls -la || true
sed -n '90,150p' README.md || true

#!/bin/bash
set -euo pipefail

# 1) Inspect plugin/router wiring around force-delete handlers.
sed -n '1,140p' plugins/clusters/plugin.go

# 2) Find router/middleware/auth wiring keywords.
rg -n --hidden --no-ignore-vcs "middleware|auth|RBAC|Role|scope|Authorize|authorization|Permission|entitle|claims|user|principal" pkg cmd plugins charts configs serve . || true

# 3) Check how handlers get context: ownership/user extracted somewhere.
rg -n --hidden --no-ignore-vcs "GetByIDAndOwner|owner|tenant|project|account|userID|principal|subject" pkg | head -200 || true

# 4) Inspect cluster/node_pool service ForceDelete implementations for any explicit authz checks.
sed -n '450,660p' pkg/services/cluster.go
sed -n '220,380p' pkg/services/node_pool.go

# 5) Inspect regular DELETE handlers to compare logic surface.
# cluster DELETE handler
sed -n '120,220p' pkg/handlers/cluster.go
# nodepool DELETE handler
sed -n '80,200p' pkg/handlers/cluster_nodepools.go

#!/bin/bash
set -euo pipefail

echo "---- pkg/services/cluster.go: ForceDelete + any SoftDelete/Delete around it ----"
rg -n "func \\(s \\*sqlClusterService\\) (ForceDelete|SoftDelete|Delete)" pkg/services/cluster.go
sed -n '430,620p' pkg/services/cluster.go

echo "---- pkg/services/node_pool.go: ForceDelete + any SoftDelete/Delete around it ----"
rg -n "func \\(s \\*sqlNodePoolService\\) (ForceDelete|SoftDelete|Delete)" pkg/services/node_pool.go
sed -n '180,360p' pkg/services/node_pool.go

echo "---- pkg/dao: ForceDelete-related queries in cluster/node_pool ----"
rg -n "ForceDelete" pkg/dao || true
rg -n "SoftDelete|Soft delete|deleted_time" pkg/dao/cluster*.go pkg/dao/*node*pool*.go || true

echo "---- handler delete endpoints (for comparison): pkg/handlers/cluster.go SoftDelete/DELETE semantics ----"
rg -n "func \\(h ClusterHandler\\) (SoftDelete|Delete|ForceDelete)" pkg/handlers/cluster.go
sed -n '120,220p' pkg/handlers/cluster.go

echo "---- handler delete endpoints (for comparison): pkg/handlers/cluster_nodepools.go SoftDelete/ForceDelete semantics ----"
rg -n "func \\(h ClusterNodePoolsHandler\\) (SoftDelete|ForceDelete)" pkg/handlers/cluster_nodepools.go
sed -n '80,200p' pkg/handlers/cluster_nodepools.go

echo "---- cmd/hyperfleet-api/server: middleware/router auth wiring (targeted) ----"
rg -n "Use\\(|middleware|auth\\.|authz|RBAC|authorize|permission|JWT|Identity" cmd/hyperfleet-api/server cmd/hyperfleet-api/environments cmd/hyperfleet-api/*.go || true

#!/bin/bash
set -euo pipefail

# Cluster service: SoftDelete implementation details
echo "---- pkg/services/cluster.go: SoftDelete (and related delete methods) ----"
sed -n '120,260p' pkg/services/cluster.go
sed -n '260,420p' pkg/services/cluster.go
sed -n '420,560p' pkg/services/cluster.go

# Node pool service: see SoftDelete/ Delete / ForceDelete call patterns re owner checks
echo "---- pkg/services/node_pool.go: SoftDelete and Delete ----"
sed -n '150,280p' pkg/services/node_pool.go
sed -n '280,360p' pkg/services/node_pool.go

# DAO cluster: see whether GetForUpdate or SoftDelete uses caller/owner scoping
echo "---- pkg/dao/cluster*.go: search for GetForUpdate / SoftDelete ownership ----"
rg -n "type .*ClusterDao|GetForUpdate|SoftDelete|DeletedTime|ByOwner|Owner" pkg/dao --glob '*cluster*' || true
rg -n "GetForUpdate\\(|SoftDelete\\(|Delete\\(" pkg/dao --glob '*cluster*' || true

# Show cluster dao implementation for GetForUpdate and any owner-filtered queries
# (we don't know filename; use fd-like search with rg results)
echo "---- showing matching cluster dao files with GetForUpdate ----"
rg -n "GetForUpdate\\(" pkg/dao --glob '*cluster*' --files-with-matches || true

# Print relevant sections from all files that define GetForUpdate in cluster dao (limited)
for f in $(rg -n "func \\(.*\\) GetForUpdate\\(" pkg/dao --glob '*cluster*' --files-with-matches); do
  echo "==== $f ===="
  sed -n '1,220p' "$f"
  sed -n '220,420p' "$f"
done || true

# Node pool DAO: GetByIDAndOwner scoping
echo "---- pkg/dao/node*pool*.go: GetByIDAndOwner ----"
rg -n "GetByIDAndOwner\\(" pkg/dao --glob '*node*pool*' || true
for f in $(rg -n "GetByIDAndOwner\\(" pkg/dao --glob '*node*pool*' --files-with-matches || true); do
  echo "==== $f ===="
  sed -n '1,260p' "$f"
done

# Handlers/tests: look for authz expectations for force-delete
echo "---- pkg/handlers/cluster_test.go: search for Unauthorized/Forbidden around ForceDelete ----"
rg -n "ForceDelete|force-delete|401|403|Unauthorized|Forbidden" pkg/handlers/cluster_test.go pkg/handlers/cluster_nodepools_test.go | head -200 || true

echo "---- pkg/handlers/cluster_nodepools_test.go: search for authz around ForceDelete ----"
rg -n "Unauthorized|Forbidden|401|403" pkg/handlers/cluster_nodepools_test.go pkg/handlers/cluster_test.go | head -200 || true

echo "---- integration tests: search for force-delete authz expectations ----"
rg -n "force-delete.*(401|403|Unauthorized|Forbidden)" test/integration -S --glob '*force*' || true
rg -n "Unauthorized|Forbidden|401|403" test/integration/clusters_test.go test/integration/node_pools_test.go | head -200 || true

#!/bin/bash
set -euo pipefail

echo "---- README.md: search for force-delete auth/RBAC/runbook text ----"
rg -n "force-delete|ForceDelete|RBAC|role|permission|authorize|authorization|runbook|safety|admin" README.md docs/api-resources.md docs/runbook.md docs/database.md || true
echo "---- README.md around line ~100-150 (includes force-delete endpoint list) ----"
sed -n '90,160p' README.md || true

echo "---- docs/api-resources.md: force-delete cluster section ----"
rg -n "POST /api/hyperfleet/v1/clusters/\\{.*\\}/force-delete|force-delete cluster|Force Delete Cluster|Force Delete" docs/api-resources.md || true
# show likely relevant sections by line ranges
sed -n '340,420p' docs/api-resources.md || true

echo "---- docs/api-resources.md: force-delete nodepool section ----"
sed -n '520,600p' docs/api-resources.md || true

echo "---- cmd/hyperfleet-api/server/routes.go: full to see if authz is wired ----"
sed -n '1,200p' cmd/hyperfleet-api/server/routes.go || true
sed -n '200,420p' cmd/hyperfleet-api/server/routes.go || true

echo "---- search cmd/hyperfleet-api/server for authorize/authz/RBAC names ----"
rg -n --no-ignore-vcs "authorize|authorization|authz|RBAC|role|permission|Scope" cmd/hyperfleet-api/server pkg/middleware pkg/auth || true

#!/bin/bash
set -euo pipefail

echo "---- Find Cluster model struct in pkg/api ----"
rg -n "type Cluster struct" pkg/api || true
# show likely file
f=$(rg -n "type Cluster struct" pkg/api --files-with-matches | head -n 1 || true)
echo "cluster struct file: $f"
if [ -n "${f:-}" ]; then
  sed -n '1,220p' "$f"
fi

echo "---- Search for owner_id / OwnerID in Cluster struct or fields ----"
rg -n "OwnerID|owner_id|owner" "$f" || true

echo "---- Confirm cluster handler SoftDelete (regular DELETE) calls service without ownership scoping ----"
sed -n '130,220p' pkg/handlers/cluster.go

echo "---- docs/api-resources.md force-delete cluster section for any RBAC/access control text ----"
# narrow by lines around "Force Delete Cluster"
rg -n "### Force Delete Cluster|Force Delete Cluster|force-delete cluster" docs/api-resources.md
# print a chunk around those lines
sed -n '350,410p' docs/api-resources.md
echo "---- docs/api-resources.md force-delete nodepool section for RBAC/access control text ----"
sed -n '540,590p' docs/api-resources.md