#!/usr/bin/env bash
set -uo pipefail

# CASAN local production-like infra lab.
#
# Usage:
#   infra-lab.sh start|stop|status|verify|env

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/casan-paths.sh"
PROJECT_ROOT="$CASAN_APP_ROOT"
COMPOSE="$PROJECT_ROOT/infra/local-prod/docker-compose.yml"
CMD="${1:-status}"

compose() {
  docker compose -f "$COMPOSE" "$@"
}

need_docker() {
  command -v docker >/dev/null 2>&1 || { echo "INFRA_LAB_DOCKER_MISSING" >&2; exit 1; }
  docker compose version >/dev/null 2>&1 || { echo "INFRA_LAB_COMPOSE_MISSING" >&2; exit 1; }
}

hash_file() {
  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
  else shasum -a 256 "$1" | awk '{print $1}'; fi
}

wait_url() {
  local url="$1"
  for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24; do
    curl -fsS -m 3 "$url" >/dev/null 2>&1 && return 0
    sleep 2
  done
  echo "INFRA_LAB_WAIT_TIMEOUT url=$url" >&2
  return 1
}

case "$CMD" in
  start)
    need_docker
    compose up -d --build
    wait_url "http://127.0.0.1:18200/v1/sys/health" || exit 1
    wait_url "http://127.0.0.1:18081/healthz" || exit 1
    wait_url "http://127.0.0.1:19090/minio/health/live" || exit 1
    wait_url "http://127.0.0.1:19092/healthz" || exit 1
    wait_url "http://127.0.0.1:19093/healthz" || exit 1
    wait_url "http://127.0.0.1:18080/healthz" || exit 1
    echo "INFRA_LAB_STARTED compose=$COMPOSE"
    ;;

  stop)
    need_docker
    compose down
    echo "INFRA_LAB_STOPPED"
    ;;

  status)
    need_docker
    compose ps
    ;;

  env)
    cat <<'EOF'
export VAULT_ADDR=http://127.0.0.1:18200
export VAULT_TOKEN=root
export CASAN_IDP_JWKS_URL=http://127.0.0.1:18081/.well-known/jwks.json
export CASAN_ALERT_WEBHOOK=http://127.0.0.1:19092/alert
export CASAN_PROVIDER_USAGE_API=http://127.0.0.1:19093/usage
export CASAN_DASHBOARD_URL=http://127.0.0.1:18080
export CASAN_DASHBOARD_AUTH=casan:casan
export CASAN_MINIO_ENDPOINT=http://127.0.0.1:19090
export CASAN_MINIO_BUCKET=casan-worm
EOF
    ;;

  verify)
    need_docker
    PASS=0; FAIL=0
    pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
    fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }

    wait_url "http://127.0.0.1:18200/v1/sys/health" && pass "Vault dev reachable" || fail "Vault dev unreachable"
    VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" enable-transit >/dev/null 2>&1
    WORK="$(mktemp -d)"
    trap 'rm -rf "$WORK"' EXIT
    printf 'infra-lab-head\n' > "$WORK/head.txt"
    if VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" sign "$WORK/head.txt" "$WORK/head.sig" casan-infra-lab >/dev/null 2>&1 \
      && VAULT_ADDR=http://127.0.0.1:18200 VAULT_TOKEN=root bash "$SCRIPT_DIR/vault-kms.sh" verify "$WORK/head.txt" "$WORK/head.sig" casan-infra-lab >/dev/null 2>&1; then
      pass "Vault Transit signs and verifies"
    else
      fail "Vault Transit sign/verify failed"
    fi

    printf 'deploy to production and run database migration\n' > "$WORK/approval.txt"
    INPUT_SHA="$(hash_file "$WORK/approval.txt")"
    TOKEN="$(curl -fsS -m 5 -H 'Content-Type: application/json' \
      -d "{\"sub\":\"oidc-ops\",\"role\":\"ops\",\"action\":\"deploy\",\"actor\":\"alice\",\"input_sha256\":\"$INPUT_SHA\",\"ttl_s\":300}" \
      http://127.0.0.1:18081/token | python3 -c 'import json,sys; print(json.load(sys.stdin)["access_token"])')" || TOKEN=""
    if [[ -n "$TOKEN" ]] && CASAN_APPROVAL_JWT="$TOKEN" CASAN_IDP_JWKS_URL="http://127.0.0.1:18081/.well-known/jwks.json" \
      bash "$SCRIPT_DIR/approval-verify.sh" deploy alice "$WORK/approval.txt" oidc-ops - >/dev/null 2>&1; then
      pass "Mock OIDC IdP issues JWKS-verifiable approval JWT"
    else
      fail "Mock OIDC approval verification failed"
    fi

    if compose run --rm minio-mc -c 'set -eu; obj="verify-$(date +%s)-$$.txt"; mc alias set local http://minio:9000 casanadmin casanadmin123 >/dev/null; printf verify >/tmp/verify.txt; mc cp /tmp/verify.txt "local/casan-worm/$obj" >/dev/null; out="$(mc retention info "local/casan-worm/$obj")"; case "$out" in *COMPLIANCE*|*Mode*) exit 0;; *) echo "$out" >&2; exit 1;; esac' >/dev/null 2>&1; then
      pass "MinIO WORM/Object Lock bucket accepts retained object"
    else
      fail "MinIO WORM verification failed"
    fi

    ALERT_FILE="$WORK/alert.json"
    printf '{"body":{"alert.type":"execution-failed","step.name":"infra-lab"},"resource":{"service.name":"casan"}}\n' > "$ALERT_FILE"
    if CASAN_AGENTOPS_DIR="$WORK/agentops" CASAN_ALERT_WEBHOOK=http://127.0.0.1:19092/alert bash "$SCRIPT_DIR/alert-dispatch.sh" "$ALERT_FILE" >/dev/null 2>&1 \
      && curl -fsS http://127.0.0.1:19092/events | grep -q "infra-lab"; then
      pass "Alert webhook receives live dispatch"
    else
      fail "Alert webhook verification failed"
    fi

    if bash "$SCRIPT_DIR/provider-usage-fetch.sh" http://127.0.0.1:19093/usage "$WORK/provider.jsonl" >/dev/null 2>&1 \
      && grep -q "provider_api" "$WORK/provider.jsonl"; then
      pass "Billing API mock imports provider telemetry"
    else
      fail "Billing API mock verification failed"
    fi

    if curl -fsS http://127.0.0.1:18080/healthz | grep -q '"status"' \
      && curl -fsS -u casan:casan http://127.0.0.1:18080/ | grep -q "AgentOps Dashboard"; then
      pass "Dashboard served behind nginx basic auth"
    else
      fail "Dashboard/nginx verification failed"
    fi

    echo "INFRA_LAB_VERIFY_SUMMARY PASS=$PASS FAIL=$FAIL"
    [[ "$FAIL" -eq 0 ]] || exit 1
    ;;

  *)
    echo "Usage: infra-lab.sh start|stop|status|verify|env" >&2
    exit 64
    ;;
esac