#!/bin/bash
set -euo pipefail

CRD="$(fd '0000_10_config-operator_01_clustermonitorings\.crd\.yaml$' | head -n1)"
if [[ -z "${CRD}" ]]; then
  echo "Could not find the generated ClusterMonitoring CRD." >&2
  exit 1
fi

python -m pip install --quiet pyyaml >/dev/null

python - "$CRD" <<'PY'
from pathlib import Path
import sys
import yaml

doc = yaml.safe_load(Path(sys.argv[1]).read_text())
versions = doc.get("spec", {}).get("versions", [])
schema = None
for version in versions:
    if version.get("name") == "v1alpha1":
        schema = version.get("schema", {}).get("openAPIV3Schema")
        break

if schema is None:
    raise SystemExit("v1alpha1 schema not found in generated CRD")

limit_nodes = []
description_hits = []

def walk(node, path):
    if isinstance(node, dict):
        if path and path[-1] == "limit" and node.get("x-kubernetes-int-or-string"):
            limit_nodes.append({
                "path": ".".join(path),
                "nullable": node.get("nullable"),
                "x-kubernetes-nullable": node.get("x-kubernetes-nullable"),
            })
        desc = node.get("description")
        if isinstance(desc, str) and "limit: null" in desc:
            description_hits.append({
                "path": ".".join(path),
                "lines": [
                    line for line in desc.splitlines()
                    if "resources:" in line or "request:" in line or "limit:" in line
                ],
            })
        for key, value in node.items():
            walk(value, path + [str(key)])
    elif isinstance(node, list):
        for index, value in enumerate(node):
            walk(value, path + [f"[{index}]"])

walk(schema, [])

print("limit schemas:")
for item in limit_nodes[:20]:
    print(item)

print("\ndescriptions containing 'limit: null':")
for item in description_hits[:20]:
    print(item["path"])
    for line in item["lines"]:
        print("  " + line)
    print()

print("nullable limit schemas found:", any(item["nullable"] or item["x-kubernetes-nullable"] for item in limit_nodes))
PY

#!/bin/bash
set -euo pipefail

FILE="payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml"

echo "Inspecting thanosQuerierConfig.resources block (Line ~4652-4705):"
awk 'NR>=4652 && NR<=4705 {print NR ":" $0}' "$FILE"

echo
echo "Regex lines that allow optional minus sign:"
rg -n "^\s*pattern:\s*\^\(\\\+\|-\)\?" "$FILE"

echo
echo "Searching for explicit positive/non-negative CEL checks in this local block:"
awk 'NR>=4652 && NR<=4705 {print NR ":" $0}' "$FILE" | rg -n "isGreaterThan|quantity\\('0'\\)|>= 0" || true

#!/bin/bash
set -euo pipefail

FILE="payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml"

# Check if the quantityComparison and CEL rules in the resource block enforce positivity
echo "=== Full x-kubernetes-validations block for this resource item ==="
awk 'NR>=4697 && NR<=4705 {print NR ":" $0}' "$FILE"

echo
echo "=== Checking if pattern allows negative quantities ==="
# Extract just the pattern line to see it clearly
awk 'NR==4667 || NR==4692' "$FILE" | sed 's/^/  /'

echo
echo "=== Looking for other resource definitions with similar patterns ==="
rg -n "pattern.*\(\\\+\|-\)\?.*\^" "$FILE" | head -20

#!/bin/bash
set -euo pipefail

FILE="payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml"

echo "=== Analyzing the CEL rule at line 4701-4702 ==="
echo "The CEL rule only checks: quantity(limit).compareTo(quantity(request)) >= 0"
echo "This enforces limit >= request, but does NOT enforce value > 0"
echo

echo "=== Testing regex pattern interpretation ==="
# Create a test pattern to show it accepts negative values
PATTERN='^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$'

echo "Current pattern allows these test cases:"
echo "-1Mi" | grep -E "$PATTERN" && echo "  ✓ '-1Mi' matches" || echo "  ✗ '-1Mi' does not match"
echo "-512m" | grep -E "$PATTERN" && echo "  ✓ '-512m' matches" || echo "  ✗ '-512m' does not match"
echo "1Gi" | grep -E "$PATTERN" && echo "  ✓ '1Gi' matches" || echo "  ✗ '1Gi' does not match"

echo
echo "=== Checking if there's any other validation preventing negative resource quantities ==="
awk 'NR>=4652 && NR<=4705 {print}' "$FILE" | grep -iE "greater|positive|zero|negative" || echo "No additional constraints found"