#!/usr/bin/env bash
# ──────────────────────────────────────────────────────────────────────────────
# UCP API test suite
# Tests the Universal Commerce Protocol REST endpoints (cart, checkout, order)
# via curl.
#
# Prerequisites:
#   make up-infra     (infra compose up — order :8092, cart :8090)
#   OR full stack     (docker compose --profile "*" up — nginx on :8080)
#
# Usage:
#   # Direct to Docker services (infra stack):
#   bash api-tests/test_ucp.sh --infra
#
#   # Via nginx (full compose stack):
#   bash api-tests/test_ucp.sh --edge
#
#   # Single service:
#   bash api-tests/test_ucp.sh --order
#   bash api-tests/test_ucp.sh --cart
#   bash api-tests/test_ucp.sh --checkout
#
#   # Verify signatures (requires signing key mounted):
#   bash api-tests/test_ucp.sh --verify-sig
# ──────────────────────────────────────────────────────────────────────────────
set -euo pipefail

MODE="${1:---infra}"
JQ="${JQ:-$(command -v jq || true)}"

# ── Base URLs ────────────────────────────────────────────────────────────────
if [ "$MODE" = "--edge" ]; then
  BASE="http://localhost:8080"
  CART_URL="$BASE"
  ORDER_URL="$BASE"
  CHECKOUT_URL="$BASE"
elif [ "$MODE" = "--order" ]; then
  ORDER_URL="http://localhost:8092"
elif [ "$MODE" = "--cart" ]; then
  CART_URL="http://localhost:8090"
elif [ "$MODE" = "--checkout" ]; then
  CART_URL="http://localhost:8090"
  CHECKOUT_URL="http://localhost:8094"
elif [ "$MODE" = "--verify-sig" ]; then
  # If signing is enabled (key mounted), you need the full stack or direct with
  # env var — try both common ports.
  ORDER_URL="${ORDER_URL:-http://localhost:8092}"
  CART_URL="${CART_URL:-http://localhost:8090}"
  CHECKOUT_URL="${CHECKOUT_URL:-http://localhost:8094}"
else
  # Default: infra stack, direct to Docker ports
  CART_URL="${CART_URL:-http://localhost:8090}"
  ORDER_URL="${ORDER_URL:-http://localhost:8092}"
  CHECKOUT_URL="${CHECKOUT_URL:-http://localhost:8094}"
fi

echo "═══════════════════════════════════════════════════════════════"
echo "  UCP API Test Suite  —  mode: $MODE"
echo "  CART:   ${CART_URL:-"(unreachable)"}"
echo "  ORDER:  ${ORDER_URL:-"(unreachable)"}"
echo "  CHECK:  ${CHECKOUT_URL:-"(unreachable)"}"
echo "═══════════════════════════════════════════════════════════════"
echo ""

# ── Helpers ──────────────────────────────────────────────────────────────────
pass() { echo "  ✅ $1"; }
fail() { echo "  ❌ $1"; }
header() { echo ""; echo "─── $1 ───"; }

check_jq() {
  if [ -z "$JQ" ]; then
    echo "  ⚠️  jq not installed — showing raw JSON instead"
  fi
}

maybe_jq() {
  if [ -n "$JQ" ]; then
    echo "$1" | jq "$2" 2>/dev/null || echo "$1" | head -c 200
  else
    echo "$1" | head -c 200
  fi
}

assert_status() {
  local label="$1" expected="$2" actual="$3" body="$4"
  if [ "$actual" -eq "$expected" ]; then
    pass "$label (HTTP $actual)"
  else
    fail "$label — expected HTTP $expected, got $actual"
    echo "    body: $(echo "$body" | head -c 300)"
  fi
}

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 1: Order service tests
# ══════════════════════════════════════════════════════════════════════════════
if [ -n "${ORDER_URL:-}" ]; then
  header "1. Order Service  →  $ORDER_URL"

  # ── Health ──────────────────────────────────────────────────────────────────
  echo "--- 1.1 Health check ---"
  resp=$(curl -sf "$ORDER_URL/healthz" 2>&1) && pass "/healthz" || fail "/healthz: $resp"

  # ── Create order via checkout ───────────────────────────────────────────────
  echo "--- 1.2 Create order via POST /checkout ---"
  create_resp=$(curl -s -w '\n%{http_code}' -X POST "$ORDER_URL/checkout" \
    -H 'Content-Type: application/json' \
    -d '{
      "orderReference": "ucp-test-1",
      "currency": "SEK",
      "lines": [
        {
          "reference": "l1",
          "sku": "TEST-SKU-1",
          "name": "Test Product",
          "quantity": 2,
          "unitPrice": 19900,
          "taxRate": 2500
        }
      ]
    }')
  create_code=$(echo "$create_resp" | tail -1)
  create_body=$(echo "$create_resp" | sed '$d')
  assert_status "Create order" 201 "$create_code" "$create_body"
  ORDER_ID=$(echo "$create_body" | sed -n 's/.*"orderId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
  if [ -n "$ORDER_ID" ]; then
    pass "Order ID: $ORDER_ID"
  else
    ORDER_ID="1"
    fail "Could not extract order ID, using '$ORDER_ID'"
    echo "    response: $(echo "$create_body" | head -c 400)"
  fi

  # ── Read order via UCP ──────────────────────────────────────────────────────
  echo "--- 1.3 GET /ucp/v1/orders/{id} ---"
  get_resp=$(curl -s -w '\n%{http_code}' "$ORDER_URL/ucp/v1/orders/$ORDER_ID")
  get_code=$(echo "$get_resp" | tail -1)
  get_body=$(echo "$get_resp" | sed '$d')
  assert_status "GET UCP order" 200 "$get_code" "$get_body"
  echo "    order: $(maybe_jq "$get_body" '.data.orderId + " status=" + .data.status')"

  # ── Cancel order ────────────────────────────────────────────────────────────
  echo "--- 1.4 POST /ucp/v1/orders/{id}/cancel ---"
  cancel_resp=$(curl -s -w '\n%{http_code}' -X POST "$ORDER_URL/ucp/v1/orders/$ORDER_ID/cancel" \
    -H 'Content-Type: application/json' \
    -d '{"reason": "test cancellation"}')
  cancel_code=$(echo "$cancel_resp" | tail -1)
  cancel_body=$(echo "$cancel_resp" | sed '$d')
  # May be 200 (cancelled) or 422 (already cancelled by flow) — both ok
  if [ "$cancel_code" = "200" ] || [ "$cancel_code" = "422" ]; then
    pass "Cancel order (HTTP $cancel_code)"
    echo "    response: $(echo "$cancel_body" | head -c 200)"
    if [ "$cancel_code" = "200" ]; then
      ORDER_CANCELLED=true
    fi
  else
    fail "Cancel order — expected 200 or 422, got $cancel_code"
    echo "    body: $(echo "$cancel_body" | head -c 300)"
  fi

  # ── 404 for non-existent order ──────────────────────────────────────────────
  echo "--- 1.5 GET non-existent order (404) ---"
  notfound_resp=$(curl -s -w '\n%{http_code}' "$ORDER_URL/ucp/v1/orders/nonexistent")
  notfound_code=$(echo "$notfound_resp" | tail -1)
  notfound_body=$(echo "$notfound_resp" | sed '$d')
  assert_status "GET non-existent" 404 "$notfound_code" "$notfound_body"

  # ── Signature headers (if enabled) ──────────────────────────────────────────
  echo "--- 1.6 Check signature headers ---"
  sig_resp=$(curl -s -i "$ORDER_URL/ucp/v1/orders/$ORDER_ID" 2>/dev/null | head -30)
  if echo "$sig_resp" | grep -qi "signature-input"; then
    pass "Signature-Input header present"
    echo "    $(echo "$sig_resp" | grep -i "signature-input" | head -1)"
  else
    echo "    ℹ️  No Signature-Input header (signing key not mounted — expected in infra stack)"
  fi
  if echo "$sig_resp" | grep -qi "^signature:"; then
    pass "Signature header present"
  else
    echo "    ℹ️  No Signature header"
  fi

  echo ""
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 2: Cart service tests
# ══════════════════════════════════════════════════════════════════════════════
if [ -n "${CART_URL:-}" ]; then
  header "2. Cart Service  →  $CART_URL"

  # ── Health ──────────────────────────────────────────────────────────────────
  echo "--- 2.1 Health check ---"
  resp=$(curl -sf "$CART_URL/healthz" 2>&1) && pass "/healthz" || fail "/healthz: $resp"

  # ── Create cart via UCP ─────────────────────────────────────────────────────
  echo "--- 2.2 POST /ucp/v1/carts/ (create cart) ---"
  # Note: must use trailing slash — Go's ServeMux with StripPrefix only
  # registers the subtree pattern (/ucp/v1/carts/) to avoid a redirect bug.
  cart_resp=$(curl -s -w '\n%{http_code}' -X POST "$CART_URL/ucp/v1/carts/" \
    -H 'Content-Type: application/json' \
    -d '{
      "currency": "SEK",
      "country": "se",
      "locale": "sv-SE"
    }')
  cart_code=$(echo "$cart_resp" | tail -1)
  cart_body=$(echo "$cart_resp" | sed '$d')
  assert_status "Create cart" 201 "$cart_code" "$cart_body"
  CART_ID=$(echo "$cart_body" | sed -n 's/.*"id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
  if [ -n "$CART_ID" ]; then
    pass "Cart ID: $CART_ID"
  else
    CART_ID="1"
    fail "Could not extract cart ID, using '$CART_ID'"
    echo "    response: $(echo "$cart_body" | head -c 400)"
  fi

  # ── Replace cart contents via UCP ───────────────────────────────────────────
  echo "--- 2.3 PUT /ucp/v1/carts/{id} ---"
  add_resp=$(curl -s -w '\n%{http_code}' -X PUT "$CART_URL/ucp/v1/carts/$CART_ID" \
    -H 'Content-Type: application/json' \
    -d '{
     "country": "se",
     "items": [
       {
         "sku": "TEST-SKU-1",
         "name": "Test Product",
         "quantity": 1,
         "price": 19900,
         "taxRate": 25
       }
     ]
    }')
  add_code=$(echo "$add_resp" | tail -1)
  add_body=$(echo "$add_resp" | sed '$d')
  assert_status "Update cart items" 200 "$add_code" "$add_body"

  # ── Get cart ────────────────────────────────────────────────────────────────
  echo "--- 2.4 GET /ucp/v1/carts/{id} ---"
  get_cart_resp=$(curl -s -w '\n%{http_code}' "$CART_URL/ucp/v1/carts/$CART_ID")
  get_cart_code=$(echo "$get_cart_resp" | tail -1)
  get_cart_body=$(echo "$get_cart_resp" | sed '$d')
  assert_status "Get cart" 200 "$get_cart_code" "$get_cart_body"
  echo "    totalIncVat: $(echo "$get_cart_body" | sed -n 's/.*"totalIncVat"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')"

  echo ""
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 3: Checkout service tests
# ══════════════════════════════════════════════════════════════════════════════
if [ -n "${CHECKOUT_URL:-}" ] && [ -n "${CART_ID:-}" ]; then
  header "3. Checkout Service  →  $CHECKOUT_URL"

  # ── Health ──────────────────────────────────────────────────────────────────
  echo "--- 3.1 Health check ---"
  resp=$(curl -sf "$CHECKOUT_URL/healthz" 2>&1) && pass "/healthz" || fail "/healthz: $resp"

  # ── Create checkout session ────────────────────────────────────────────────
  echo "--- 3.2 POST /ucp/v1/checkout-sessions/ ---"
  checkout_resp=$(curl -s -w '\n%{http_code}' -X POST "$CHECKOUT_URL/ucp/v1/checkout-sessions/" \
    -H 'Content-Type: application/json' \
    -d '{
     "cartId": "'"$CART_ID"'",
     "currency": "SEK",
     "country": "se"
    }')
  checkout_code=$(echo "$checkout_resp" | tail -1)
  checkout_body=$(echo "$checkout_resp" | sed '$d')
  assert_status "Create checkout session" 201 "$checkout_code" "$checkout_body"
  CHECKOUT_ID=$(echo "$checkout_body" | sed -n 's/.*"id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
  if [ -n "$CHECKOUT_ID" ]; then
    pass "Checkout ID: $CHECKOUT_ID"
  else
    fail "Could not extract checkout ID"
    echo "    response: $(echo "$checkout_body" | head -c 400)"
  fi

  if [ -n "${CHECKOUT_ID:-}" ]; then
    # ── Read checkout session ────────────────────────────────────────────────
    echo "--- 3.3 GET /ucp/v1/checkout-sessions/{id} ---"
    get_checkout_resp=$(curl -s -w '\n%{http_code}' "$CHECKOUT_URL/ucp/v1/checkout-sessions/$CHECKOUT_ID")
    get_checkout_code=$(echo "$get_checkout_resp" | tail -1)
    get_checkout_body=$(echo "$get_checkout_resp" | sed '$d')
    assert_status "Get checkout session" 200 "$get_checkout_code" "$get_checkout_body"
    echo "    checkout: $(maybe_jq "$get_checkout_body" '.id + " status=" + .status')"

    # ── Complete checkout session ────────────────────────────────────────────
    echo "--- 3.4 POST /ucp/v1/checkout-sessions/{id}/complete ---"
    complete_resp=$(curl -s -w '\n%{http_code}' -X POST "$CHECKOUT_URL/ucp/v1/checkout-sessions/$CHECKOUT_ID/complete" \
      -H 'Content-Type: application/json' \
      -d '{
        "provider": "test",
        "paymentToken": "ucp-test-payment-token",
        "currency": "SEK",
        "country": "se"
      }')
    complete_code=$(echo "$complete_resp" | tail -1)
    complete_body=$(echo "$complete_resp" | sed '$d')
    assert_status "Complete checkout session" 200 "$complete_code" "$complete_body"
    COMPLETE_ORDER_ID=$(echo "$complete_body" | sed -n 's/.*"orderId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
    if [ -n "$COMPLETE_ORDER_ID" ]; then
      pass "Checkout produced order ID: $COMPLETE_ORDER_ID"
    else
      fail "Checkout completion did not return an orderId"
      echo "    response: $(echo "$complete_body" | head -c 400)"
    fi

    # ── Signature headers (if enabled) ──────────────────────────────────────
    echo "--- 3.5 Check signature headers ---"
    checkout_sig_resp=$(curl -s -i "$CHECKOUT_URL/ucp/v1/checkout-sessions/$CHECKOUT_ID" 2>/dev/null | head -30)
    if echo "$checkout_sig_resp" | grep -qi "signature-input"; then
      pass "Checkout Signature-Input header present"
      echo "    $(echo "$checkout_sig_resp" | grep -i "signature-input" | head -1)"
    else
      echo "    ℹ️  No Signature-Input header"
    fi
    if echo "$checkout_sig_resp" | grep -qi "^signature:"; then
      pass "Checkout Signature header present"
    else
      echo "    ℹ️  No Signature header"
    fi
  fi
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 4: Edge-only discovery artifact tests
# ══════════════════════════════════════════════════════════════════════════════
if [ "$MODE" = "--edge" ]; then
  header "4. Edge Discovery  →  $BASE"

  echo "--- 4.1 GET /.well-known/ucp ---"
  profile_resp=$(curl -s -w '\n%{http_code}' "$BASE/.well-known/ucp")
  profile_code=$(echo "$profile_resp" | tail -1)
  profile_body=$(echo "$profile_resp" | sed '$d')
  assert_status "Get UCP profile" 200 "$profile_code" "$profile_body"
  if echo "$profile_body" | grep -q '/.well-known/ucp/openapi/shopping-rest.openapi.json'; then
    pass "Profile advertises self-hosted REST OpenAPI"
  else
    fail "Profile is missing self-hosted REST OpenAPI URL"
  fi

  echo "--- 4.2 GET /.well-known/ucp/openapi/shopping-rest.openapi.json ---"
  openapi_resp=$(curl -s -w '\n%{http_code}' "$BASE/.well-known/ucp/openapi/shopping-rest.openapi.json")
  openapi_code=$(echo "$openapi_resp" | tail -1)
  openapi_body=$(echo "$openapi_resp" | sed '$d')
  assert_status "Get UCP REST OpenAPI" 200 "$openapi_code" "$openapi_body"
  if echo "$openapi_body" | grep -q '"openapi"'; then
    pass "OpenAPI document returned"
  else
    fail "OpenAPI document body missing openapi field"
  fi

  echo "--- 4.3 GET self-hosted UCP schemas ---"
  for schema_path in \
    "/.well-known/ucp/schemas/shopping/customer.json" \
    "/.well-known/ucp/schemas/shopping/authentication.json" \
    "/.well-known/ucp/schemas/payments/processor_tokenizer.json"
  do
    schema_resp=$(curl -s -w '\n%{http_code}' "$BASE$schema_path")
    schema_code=$(echo "$schema_resp" | tail -1)
    schema_body=$(echo "$schema_resp" | sed '$d')
    assert_status "Get $schema_path" 200 "$schema_code" "$schema_body"
    if echo "$schema_body" | grep -q '"$schema"'; then
      pass "$schema_path is valid schema JSON"
    else
      fail "$schema_path body missing \$schema"
    fi
  done
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 5: Signature verification (standalone)
# ══════════════════════════════════════════════════════════════════════════════
if [ "$MODE" = "--verify-sig" ]; then
  header "5. Signature Verification"

  # Verify that the response includes RFC 9421 HTTP Message Signatures.
  # Requires the service to have UCP_SIGNING_KEY_PATH set and the key mounted.
  echo "--- 5.1 Check Signed Response ---"
  sig_output=$(curl -s -D - "$ORDER_URL/ucp/v1/orders/$ORDER_ID" 2>/dev/null | head -40)

  echo "$sig_output" | while IFS= read -r line; do
    if echo "$line" | grep -qiE "(signature-input|signature:|x-ucp-timestamp|content-type)"; then
      echo "    $line"
    fi
  done

  echo ""
  echo "  To manually verify:"
  echo "    1. Extract the Signature-Input and Signature headers"
  echo "    2. Reconstruct the signature base string per RFC 9421 §2.2"
  echo "    3. Verify using the public key (x/y in docs/ucp-profile.json)"
  echo ""
fi

# ══════════════════════════════════════════════════════════════════════════════
echo "═══════════════════════════════════════════════════════════════"
echo "  Done."
echo ""
echo "  Note: devProxies for /ucp/v1/* are now in islands.config.json."
echo "  Run 'make dev' for same-origin proxied access."
echo "═══════════════════════════════════════════════════════════════"