#!/usr/bin/env bash
set -uo pipefail

# Plan-13 local production-like smoke:
# TLS self-signed + mock OIDC IdP + oauth2-proxy + nginx auth_request + CP API.

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
COMPOSE="$ROOT/docker-compose.control-panel.local.yml"
TLS_DIR="$ROOT/tmp/control-panel-local/tls"
BASE="https://localhost:18443"

mkdir -p "$TLS_DIR"
if [[ ! -f "$TLS_DIR/tls.crt" || ! -f "$TLS_DIR/tls.key" ]]; then
  openssl req -x509 -newkey rsa:2048 -nodes \
    -keyout "$TLS_DIR/tls.key" \
    -out "$TLS_DIR/tls.crt" \
    -subj "/CN=localhost" \
    -days 1 >/dev/null 2>&1
fi

cleanup() {
  docker compose -f "$COMPOSE" down --remove-orphans >/dev/null 2>&1 || true
}
trap cleanup EXIT

fail() {
  echo "$1"
  docker compose -f "$COMPOSE" logs --tail=120 control-panel-api control-panel-ui oauth2-proxy idp || true
  exit 1
}

docker compose -f "$COMPOSE" up -d --build >/tmp/casan-cp-local-smoke-up.log 2>&1 || {
  cat /tmp/casan-cp-local-smoke-up.log
  exit 1
}

for _ in $(seq 1 60); do
  if curl -k -s -I "$BASE/" >/dev/null 2>&1; then
    break
  fi
  sleep 1
done

JAR="$(mktemp)"
trap 'rm -f "$JAR"; cleanup' EXIT

curl -k -s -L -c "$JAR" -b "$JAR" "$BASE/" -o /tmp/casan-cp-local-index.html -w "%{http_code}" > /tmp/casan-cp-local-index.code
INDEX_CODE="$(cat /tmp/casan-cp-local-index.code)"
if [[ "$INDEX_CODE" != "200" ]] || ! grep -q "CASAN Ops Console" /tmp/casan-cp-local-index.html; then
  echo "CP_LOCAL_SMOKE_FAIL ui_http=$INDEX_CODE"
  tail -100 /tmp/casan-cp-local-index.html
  fail "CP_LOCAL_SMOKE_FAIL ui_unexpected"
fi

for _ in $(seq 1 30); do
  curl -k -s -L -c "$JAR" -b "$JAR" "$BASE/api/v1/settings" -o /tmp/casan-cp-local-settings.json -w "%{http_code}" > /tmp/casan-cp-local-settings.code
  SETTINGS_CODE="$(cat /tmp/casan-cp-local-settings.code)"
  [[ "$SETTINGS_CODE" == "200" ]] && break
  sleep 1
done
SETTINGS_CODE="$(cat /tmp/casan-cp-local-settings.code)"
if [[ "$SETTINGS_CODE" != "200" ]]; then
  echo "CP_LOCAL_SMOKE_FAIL settings_http=$SETTINGS_CODE"
  cat /tmp/casan-cp-local-settings.json
  fail "CP_LOCAL_SMOKE_FAIL settings_unexpected"
fi

for _ in $(seq 1 30); do
  curl -k -s -L -c "$JAR" -b "$JAR" "$BASE/api/v1/command" -o /tmp/casan-cp-local-command.json -w "%{http_code}" > /tmp/casan-cp-local-command.code
  COMMAND_CODE="$(cat /tmp/casan-cp-local-command.code)"
  [[ "$COMMAND_CODE" == "200" ]] && break
  sleep 1
done
COMMAND_CODE="$(cat /tmp/casan-cp-local-command.code)"
if [[ "$COMMAND_CODE" != "200" ]]; then
  echo "CP_LOCAL_SMOKE_FAIL command_http=$COMMAND_CODE"
  cat /tmp/casan-cp-local-command.json
  fail "CP_LOCAL_SMOKE_FAIL command_unexpected"
fi

python3 - <<'PY'
import json
data = json.load(open('/tmp/casan-cp-local-settings.json'))
actor = data.get('data', {}).get('actor', {})
assert actor.get('actor') == 'oidc-ops', actor
assert actor.get('role') == 'org-admin', actor
assert data.get('success') is True
command = json.load(open('/tmp/casan-cp-local-command.json'))
widgets = command.get('data', {}).get('widgets', {})
assert command.get('success') is True
assert len(widgets) == 9, widgets.keys()
assert 'chat_loop' in widgets, widgets.keys()
for widget in widgets.values():
    envelope = widget.get('envelope', {})
    assert {'source', 'artifact_path', 'commit', 'run_at', 'verified', 'status'} <= set(envelope), envelope
print('CP_LOCAL_SMOKE_PASS https_oidc=true actor=oidc-ops role=org-admin')
PY

CASAN_CP_BASE_URL="$BASE" \
CASAN_CP_ALLOW_INSECURE=1 \
CASAN_CP_COOKIE_JAR="$JAR" \
  bash "$ROOT/packages/casan-control-panel/scripts/managed-prod-smoke.sh" >/tmp/casan-cp-local-managed-smoke.out
cat /tmp/casan-cp-local-managed-smoke.out