#!/usr/bin/env bash
# End-to-end check of a running dev overlay (see deploy/k8s/README.md):
# probes, registration via real SMTP (Mailpit), activation, login, and
# LDAP failover (ldap1 is scaled to zero and back).
#
#   deploy/k8s/dev/e2e.sh
set -euo pipefail

NS=${NS:-ungleich-user-dev}
APP=http://localhost:8080
MAIL=http://localhost:8025
WORK=$(mktemp -d)
FAILED=0

PIDS=()
cleanup() {
  kill "${PIDS[@]}" 2>/dev/null || true
  kubectl -n "$NS" scale deploy/ldap1 --replicas=1 >/dev/null 2>&1 || true
  rm -rf "$WORK"
}
trap cleanup EXIT

check() {  # check <name> <expected substring> <actual>
  if [[ "$3" == *"$2"* ]]; then echo "PASS  $1"; else echo "FAIL  $1 (got: ${3:0:200})"; FAILED=1; fi
}

kubectl -n "$NS" port-forward svc/ungleich-user 8080:80 >/dev/null 2>&1 & PIDS+=($!); disown
kubectl -n "$NS" port-forward svc/mailpit 8025:8025 >/dev/null 2>&1 & PIDS+=($!); disown
for _ in $(seq 1 30); do curl -sf "$APP/healthz" >/dev/null 2>&1 && break; sleep 1; done

# Each "browser" gets its own cookie jar; post <jar> <path> <form data>
post() {
  curl -s -c "$1" -b "$1" "$APP$2" -o /dev/null
  local tok; tok=$(awk '/csrftoken/{print $7}' "$1")
  curl -s -c "$1" -b "$1" -H "Referer: $APP$2" --data "csrfmiddlewaretoken=$tok&$3" "$APP$2"
}

check "liveness"  '"status": "ok"' "$(curl -s "$APP/healthz")"
check "readiness" '"ldap": "ok"'   "$(curl -s "$APP/readyz")"

USER=e2e-$RANDOM$RANDOM
PASS=e2e-pass-$RANDOM$RANDOM
curl -s -X DELETE "$MAIL/api/v1/messages" >/dev/null
check "register form" "Verify your email" \
  "$(post "$WORK/a" /register/ "username=$USER&password1=$PASS&password2=$PASS&email=$USER@example.com&firstname=E2e&lastname=Test")"

MSG_ID=""
for _ in $(seq 1 10); do
  MSG_ID=$(curl -s "$MAIL/api/v1/messages" | python3 -c 'import json,sys; m=json.load(sys.stdin)["messages"]; print(m[0]["ID"] if m else "")')
  [[ -n "$MSG_ID" ]] && break; sleep 1
done
BODY=$(curl -s "$MAIL/api/v1/message/$MSG_ID" | python3 -c 'import json,sys; print(json.load(sys.stdin)["Text"])')
LINK=$(grep -oE "$APP/activate/[^ \"<>]+" <<<"$BODY" | head -1 || true)
check "activation email via SMTP" "/activate/" "$LINK"
check "no password in email" "ok" "$([[ "$BODY" == *"$PASS"* ]] && echo leaked || echo ok)"
check "activation" "User $USER created" "$(curl -s "$LINK")"
check "login as new user" "Options for $USER" \
  "$(post "$WORK/b" /index/ "username=$USER&password=$PASS")"

kubectl -n "$NS" scale deploy/ldap1 --replicas=0 >/dev/null
kubectl -n "$NS" wait --for=delete pod -l app=ldap1 --timeout=60s >/dev/null 2>&1 || true
check "login with ldap1 down (failover)" "Options for customer1" \
  "$(post "$WORK/c" /index/ "username=customer1&password=customerpass")"
check "readiness with ldap1 down" '"ldap": "ok"' "$(curl -s "$APP/readyz")"
kubectl -n "$NS" scale deploy/ldap1 --replicas=1 >/dev/null

exit $FAILED