#!/usr/bin/env bash
# ──────────────────────────────────────────────────────────────────────────────
# UCP API test suite
# Tests the Universal Commerce Protocol REST endpoints (cart, order) via curl.
#
# Prerequisites:
#   make up-infra     (infra compose up — order :8092, cart :8090)
#   OR full stack     (docker compose --profile "*" up — nginx on :8080)
#
# Usage:
#   # Direct to Docker services (infra stack):
#   bash api-tests/test_ucp.sh --infra
#
#   # Via nginx (full compose stack):
#   bash api-tests/test_ucp.sh --edge
#
#   # Single service:
#   bash api-tests/test_ucp.sh --order
#   bash api-tests/test_ucp.sh --cart
#
#   # Verify signatures (requires signing key mounted):
#   bash api-tests/test_ucp.sh --verify-sig
# ──────────────────────────────────────────────────────────────────────────────
set -euo pipefail

MODE="${1:---infra}"
JQ="${JQ:-$(command -v jq || true)}"

# ── Base URLs ────────────────────────────────────────────────────────────────
if [ "$MODE" = "--edge" ]; then
  BASE="http://localhost:8080"
  CART_URL="$BASE"
  ORDER_URL="$BASE"
  CHECKOUT_URL="$BASE"
elif [ "$MODE" = "--order" ]; then
  ORDER_URL="http://localhost:8092"
elif [ "$MODE" = "--cart" ]; then
  CART_URL="http://localhost:8090"
elif [ "$MODE" = "--verify-sig" ]; then
  # If signing is enabled (key mounted), you need the full stack or direct with
  # env var — try both common ports.
  ORDER_URL="${ORDER_URL:-http://localhost:8092}"
  CART_URL="${CART_URL:-http://localhost:8090}"
else
  # Default: infra stack, direct to Docker ports
  CART_URL="${CART_URL:-http://localhost:8090}"
  ORDER_URL="${ORDER_URL:-http://localhost:8092}"
  CHECKOUT_URL="${CHECKOUT_URL:-}"
fi

echo "═══════════════════════════════════════════════════════════════"
echo "  UCP API Test Suite  —  mode: $MODE"
echo "  CART:   ${CART_URL:-"(unreachable)"}"
echo "  ORDER:  ${ORDER_URL:-"(unreachable)"}"
echo "  CHECK:  ${CHECKOUT_URL:-"(unreachable)"}"
echo "═══════════════════════════════════════════════════════════════"
echo ""

# ── Helpers ──────────────────────────────────────────────────────────────────
pass() { echo "  ✅ $1"; }
fail() { echo "  ❌ $1"; }
header() { echo ""; echo "─── $1 ───"; }

check_jq() {
  if [ -z "$JQ" ]; then
    echo "  ⚠️  jq not installed — showing raw JSON instead"
  fi
}

maybe_jq() {
  if [ -n "$JQ" ]; then
    echo "$1" | jq "$2" 2>/dev/null || echo "$1" | head -c 200
  else
    echo "$1" | head -c 200
  fi
}

assert_status() {
  local label="$1" expected="$2" actual="$3" body="$4"
  if [ "$actual" -eq "$expected" ]; then
    pass "$label (HTTP $actual)"
  else
    fail "$label — expected HTTP $expected, got $actual"
    echo "    body: $(echo "$body" | head -c 300)"
  fi
}

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 1: Order service tests
# ══════════════════════════════════════════════════════════════════════════════
if [ -n "${ORDER_URL:-}" ]; then
  header "1. Order Service  →  $ORDER_URL"

  # ── Health ──────────────────────────────────────────────────────────────────
  echo "--- 1.1 Health check ---"
  resp=$(curl -sf "$ORDER_URL/healthz" 2>&1) && pass "/healthz" || fail "/healthz: $resp"

  # ── Create order via checkout ───────────────────────────────────────────────
  echo "--- 1.2 Create order via POST /checkout ---"
  create_resp=$(curl -s -w '\n%{http_code}' -X POST "$ORDER_URL/checkout" \
    -H 'Content-Type: application/json' \
    -d '{
      "orderReference": "ucp-test-1",
      "currency": "SEK",
      "lines": [
        {
          "reference": "l1",
          "sku": "TEST-SKU-1",
          "name": "Test Product",
          "quantity": 2,
          "unitPrice": 19900,
          "taxRate": 2500
        }
      ]
    }')
  create_code=$(echo "$create_resp" | tail -1)
  create_body=$(echo "$create_resp" | sed '$d')
  assert_status "Create order" 201 "$create_code" "$create_body"
  ORDER_ID=$(echo "$create_body" | sed -n 's/.*"orderId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
  if [ -n "$ORDER_ID" ]; then
    pass "Order ID: $ORDER_ID"
  else
    ORDER_ID="1"
    fail "Could not extract order ID, using '$ORDER_ID'"
    echo "    response: $(echo "$create_body" | head -c 400)"
  fi

  # ── Read order via UCP ──────────────────────────────────────────────────────
  echo "--- 1.3 GET /ucp/v1/orders/{id} ---"
  get_resp=$(curl -s -w '\n%{http_code}' "$ORDER_URL/ucp/v1/orders/$ORDER_ID")
  get_code=$(echo "$get_resp" | tail -1)
  get_body=$(echo "$get_resp" | sed '$d')
  assert_status "GET UCP order" 200 "$get_code" "$get_body"
  echo "    order: $(maybe_jq "$get_body" '.data.orderId + " status=" + .data.status')"

  # ── Cancel order ────────────────────────────────────────────────────────────
  echo "--- 1.4 POST /ucp/v1/orders/{id}/cancel ---"
  cancel_resp=$(curl -s -w '\n%{http_code}' -X POST "$ORDER_URL/ucp/v1/orders/$ORDER_ID/cancel" \
    -H 'Content-Type: application/json' \
    -d '{"reason": "test cancellation"}')
  cancel_code=$(echo "$cancel_resp" | tail -1)
  cancel_body=$(echo "$cancel_resp" | sed '$d')
  # May be 200 (cancelled) or 422 (already cancelled by flow) — both ok
  if [ "$cancel_code" = "200" ] || [ "$cancel_code" = "422" ]; then
    pass "Cancel order (HTTP $cancel_code)"
    echo "    response: $(echo "$cancel_body" | head -c 200)"
    if [ "$cancel_code" = "200" ]; then
      ORDER_CANCELLED=true
    fi
  else
    fail "Cancel order — expected 200 or 422, got $cancel_code"
    echo "    body: $(echo "$cancel_body" | head -c 300)"
  fi

  # ── 404 for non-existent order ──────────────────────────────────────────────
  echo "--- 1.5 GET non-existent order (404) ---"
  notfound_resp=$(curl -s -w '\n%{http_code}' "$ORDER_URL/ucp/v1/orders/nonexistent")
  notfound_code=$(echo "$notfound_resp" | tail -1)
  notfound_body=$(echo "$notfound_resp" | sed '$d')
  assert_status "GET non-existent" 404 "$notfound_code" "$notfound_body"

  # ── Signature headers (if enabled) ──────────────────────────────────────────
  echo "--- 1.6 Check signature headers ---"
  sig_resp=$(curl -s -i "$ORDER_URL/ucp/v1/orders/$ORDER_ID" 2>/dev/null | head -30)
  if echo "$sig_resp" | grep -qi "signature-input"; then
    pass "Signature-Input header present"
    echo "    $(echo "$sig_resp" | grep -i "signature-input" | head -1)"
  else
    echo "    ℹ️  No Signature-Input header (signing key not mounted — expected in infra stack)"
  fi
  if echo "$sig_resp" | grep -qi "^signature:"; then
    pass "Signature header present"
  else
    echo "    ℹ️  No Signature header"
  fi

  echo ""
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 2: Cart service tests
# ══════════════════════════════════════════════════════════════════════════════
if [ -n "${CART_URL:-}" ]; then
  header "2. Cart Service  →  $CART_URL"

  # ── Health ──────────────────────────────────────────────────────────────────
  echo "--- 2.1 Health check ---"
  resp=$(curl -sf "$CART_URL/healthz" 2>&1) && pass "/healthz" || fail "/healthz: $resp"

  # ── Create cart via UCP ─────────────────────────────────────────────────────
  echo "--- 2.2 POST /ucp/v1/carts/ (create cart) ---"
  # Note: must use trailing slash — Go's ServeMux with StripPrefix only
  # registers the subtree pattern (/ucp/v1/carts/) to avoid a redirect bug.
  cart_resp=$(curl -s -w '\n%{http_code}' -X POST "$CART_URL/ucp/v1/carts/" \
    -H 'Content-Type: application/json' \
    -d '{
      "currency": "SEK",
      "country": "se",
      "locale": "sv-SE"
    }')
  cart_code=$(echo "$cart_resp" | tail -1)
  cart_body=$(echo "$cart_resp" | sed '$d')
  assert_status "Create cart" 201 "$cart_code" "$cart_body"
  CART_ID=$(echo "$cart_body" | sed -n 's/.*"id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
  if [ -n "$CART_ID" ]; then
    pass "Cart ID: $CART_ID"
  else
    CART_ID="1"
    fail "Could not extract cart ID, using '$CART_ID'"
    echo "    response: $(echo "$cart_body" | head -c 400)"
  fi

  # ── Add item to cart ────────────────────────────────────────────────────────
  echo "--- 2.3 POST /ucp/v1/carts/{id}/items ---"
  add_resp=$(curl -s -w '\n%{http_code}' -X POST "$CART_URL/ucp/v1/carts/$CART_ID/items" \
    -H 'Content-Type: application/json' \
    -d '{
      "sku": "TEST-SKU-1",
      "name": "Test Product",
      "quantity": 1,
      "unitPrice": 19900,
      "taxRate": 2500
    }')
  add_code=$(echo "$add_resp" | tail -1)
  add_body=$(echo "$add_resp" | sed '$d')
  assert_status "Add item" 201 "$add_code" "$add_body"

  # ── Get cart ────────────────────────────────────────────────────────────────
  echo "--- 2.4 GET /ucp/v1/carts/{id} ---"
  get_cart_resp=$(curl -s -w '\n%{http_code}' "$CART_URL/ucp/v1/carts/$CART_ID")
  get_cart_code=$(echo "$get_cart_resp" | tail -1)
  get_cart_body=$(echo "$get_cart_resp" | sed '$d')
  assert_status "Get cart" 200 "$get_cart_code" "$get_cart_body"
  echo "    total: $(echo "$get_cart_body" | sed -n 's/.*"total"[[:space:]]*:[[:space:]]*\([0-9]*\).*/\1/p')"

  echo ""
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 3: Full flow — cart → checkout → order (via edge/nginx only)
# ══════════════════════════════════════════════════════════════════════════════
if [ "$MODE" = "--edge" ] && [ -n "${CHECKOUT_URL:-}" ]; then
  header "3. Full Flow (via nginx)"

  # ── This section needs the full compose stack with nginx on :8080,
  #    and checkout must be reachable. Skip for infra/direct modes.
  echo "--- 3.1 Create checkout session ---"
  checkout_resp=$(curl -s -w '\n%{http_code}' -X POST "$CHECKOUT_URL/ucp/v1/checkout-sessions" \
    -H 'Content-Type: application/json' \
    -d '{
      "cartId": "'"$CART_ID"'",
      "currency": "SEK",
      "country": "se"
    }')
  checkout_code=$(echo "$checkout_resp" | tail -1)
  checkout_body=$(echo "$checkout_resp" | sed '$d')
  assert_status "Create checkout session" 201 "$checkout_code" "$checkout_body"
fi

# ══════════════════════════════════════════════════════════════════════════════
# SECTION 4: Signature verification (standalone)
# ══════════════════════════════════════════════════════════════════════════════
if [ "$MODE" = "--verify-sig" ]; then
  header "4. Signature Verification"

  # Verify that the response includes RFC 9421 HTTP Message Signatures.
  # Requires the service to have UCP_SIGNING_KEY_PATH set and the key mounted.
  echo "--- 4.1 Check Signed Response ---"
  sig_output=$(curl -s -D - "$ORDER_URL/ucp/v1/orders/$ORDER_ID" 2>/dev/null | head -40)

  echo "$sig_output" | while IFS= read -r line; do
    if echo "$line" | grep -qiE "(signature-input|signature:|x-ucp-timestamp|content-type)"; then
      echo "    $line"
    fi
  done

  echo ""
  echo "  To manually verify:"
  echo "    1. Extract the Signature-Input and Signature headers"
  echo "    2. Reconstruct the signature base string per RFC 9421 §2.2"
  echo "    3. Verify using the public key (x/y in docs/ucp-profile.json)"
  echo ""
fi

# ══════════════════════════════════════════════════════════════════════════════
echo "═══════════════════════════════════════════════════════════════"
echo "  Done."
echo ""
echo "  Note: devProxies for /ucp/v1/* are now in islands.config.json."
echo "  Run 'make dev' for same-origin proxied access."
echo "═══════════════════════════════════════════════════════════════"