#!/usr/bin/env bash
# Phase 1 definition of done (AUD-103).
#
#   - the container is up and healthy
#   - GET /health returns 200 with status ok
#   - the login page renders and a session login succeeds
#   - the Caddy route on .35 serves school.lab.audasmedia.com.au
#
# Run on .13 from the project folder. It reads the admin password from
# environment.d/school-service.env, never prints it, and never touches the
# school's systems.
set -u

BASE="${SCHOOL_VERIFY_BASE:-http://127.0.0.1:8792}"
PUBLIC="${SCHOOL_VERIFY_PUBLIC:-https://school.lab.audasmedia.com.au}"
ENV_FILE="${SCHOOL_ENV_FILE:-environment.d/school-service.env}"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT

fail=0
pass() { printf 'PASS  %s\n' "$1"; }
bad()  { printf 'FAIL  %s\n' "$1"; fail=1; }

echo "== container =="
timeout 60 docker compose ps || true

echo
echo "== GET /health =="
code="$(curl -sS -o "$TMP/health.json" -w '%{http_code}' "$BASE/health" || echo 000)"
body="$(cat "$TMP/health.json" 2>/dev/null)"
printf 'HTTP %s\n%s\n' "$code" "$body"
if [ "$code" = "200" ] && printf '%s' "$body" | grep -q '"status":"ok"'; then
  pass "/health 200 and status ok"
else
  bad "/health did not return 200 status ok"
fi

echo
echo "== login page =="
curl -sS -c "$TMP/cookies" -o "$TMP/login.html" -w 'HTTP %{http_code}\n' "$BASE/login"
if grep -q 'name="csrf"' "$TMP/login.html"; then
  pass "login page renders with a csrf token"
else
  bad "login page did not render a csrf token"
fi

echo
echo "== session login =="
# Extract the plaintext password or use the hash-only path. With a hash-only
# env file the operator must supply SCHOOL_VERIFY_PASSWORD.
pw="${SCHOOL_VERIFY_PASSWORD:-}"
if [ -z "$pw" ] && [ -f "$ENV_FILE" ]; then
  pw="$(sed -n 's/^SCHOOL_ADMIN_PASSWORD=//p' "$ENV_FILE" | head -1)"
fi
csrf="$(grep -o 'name="csrf" value="[^"]*"' "$TMP/login.html" | head -1 | sed 's/.*value="//; s/"//')"
if [ -z "$pw" ]; then
  echo "SKIP  no SCHOOL_VERIFY_PASSWORD and no plaintext password in $ENV_FILE"
elif [ -z "$csrf" ]; then
  bad "no csrf token to submit"
else
  code="$(curl -sS -b "$TMP/cookies" -c "$TMP/cookies" -o /dev/null -w '%{http_code}' \
    -d "csrf=$csrf" -d "username=sam" -d "password=$pw" "$BASE/login")"
  if [ "$code" = "303" ]; then
    dash="$(curl -sS -b "$TMP/cookies" -o "$TMP/dash.html" -w '%{http_code}' "$BASE/")"
    if [ "$dash" = "200" ] && grep -q 'What is due' "$TMP/dash.html"; then
      pass "session login succeeds and the dashboard renders"
    else
      bad "dashboard did not render after login (HTTP $dash)"
    fi
  else
    bad "login POST returned $code, expected 303"
  fi
fi

echo
echo "== Caddy route (.35) =="
code="$(curl -sS -o "$TMP/pub.json" -D "$TMP/pub.headers" -w '%{http_code}' --max-time 25 "$PUBLIC/health" || echo 000)"
printf 'HTTP %s\n' "$code"
grep -i '^server:' "$TMP/pub.headers" 2>/dev/null || true
grep -i '^content-type:' "$TMP/pub.headers" 2>/dev/null || true
if [ "$code" = "200" ] && grep -qi '^server: Caddy' "$TMP/pub.headers"; then
  pass "Caddy serves $PUBLIC/health"
else
  bad "Caddy route did not answer 200 (HTTP $code)"
fi

echo
if [ "$fail" = "0" ]; then
  echo "RESULT: Phase 1 verified"
else
  echo "RESULT: Phase 1 verification FAILED"
fi
exit "$fail"