#!/usr/bin/env bash
#
# Phase 8 definition of done: prove that a lock issued through the admin API
# reaches a device in under one second.
#
# It issues POST /api/v1/admin/devices/<id>/lock and measures the time from the
# request to the moment a real broker subscriber receives the retained
# restrict/<device>/config message over the 8883 TLS plane. Nothing shared is
# restarted or reconfigured: it only needs the Control Service (and its broker
# link) already running, the admin API token, and a device account from
# deploy/mosquitto/clients.env.
#
# Usage:
#   make verify-phase8
#   DEVICE_ID=2 deploy/verify-phase8.sh
#
# The device is unlocked again at the end, so the proof leaves no lock behind.

set -euo pipefail

cd "$(dirname "$0")/.."

SERVICE_URL="${CONTROL_BASE_URL:-http://127.0.0.1:8791}"
CA_FILE="${MQTT_CA_FILE:-deploy/mosquitto/tls/ca.crt}"
CLIENTS_FILE="${MQTT_CLIENTS_FILE:-deploy/mosquitto/clients.env}"
ENV_FILE="${CONTROL_ENV_FILE:-environment.d/control-service.env}"
MQTT_IMAGE="${MQTT_IMAGE:-eclipse-mosquitto:latest}"
DEVICE_ID="${DEVICE_ID:-}"

die() { echo "verify-phase8: $*" >&2; exit 1; }

# The token may be exported or live in the service env file. Never echo it.
TOKEN="${CONTROL_ADMIN_API_TOKEN:-}"
if [[ -z "$TOKEN" && -f "$ENV_FILE" ]]; then
  TOKEN="$(grep -E '^CONTROL_ADMIN_API_TOKEN=' "$ENV_FILE" | head -1 | cut -d= -f2- || true)"
fi
[[ -n "$TOKEN" ]] || die "set CONTROL_ADMIN_API_TOKEN or add it to $ENV_FILE"

[[ -f "$CA_FILE" ]] || die "missing CA file $CA_FILE"
[[ -f "$CLIENTS_FILE" ]] || die "missing device credentials $CLIENTS_FILE"

api() {
  # api <method> <path> [json-body]
  local method="$1" path="$2" body="${3:-}"
  if [[ -n "$body" ]]; then
    curl -sS -X "$method" -H "Authorization: Bearer $TOKEN" \
      -H 'Content-Type: application/json' -d "$body" "$SERVICE_URL$path"
  else
    curl -sS -X "$method" -H "Authorization: Bearer $TOKEN" "$SERVICE_URL$path"
  fi
}

# Pick a device.
if [[ -n "$DEVICE_ID" ]]; then
  devices_json="$(api GET "/api/v1/admin/devices/$DEVICE_ID")"
  echo "$devices_json" | jq -e '.ok == true' >/dev/null || die "device $DEVICE_ID not found: $devices_json"
else
  devices_json="$(api GET /api/v1/admin/devices)"
  echo "$devices_json" | jq -e '.ok == true and (.devices | length > 0)' >/dev/null \
    || die "no devices: $devices_json"
  DEVICE_ID="$(echo "$devices_json" | jq -r '.devices[0].id')"
fi

device_name="$(echo "$devices_json" | jq -r --argjson id "$DEVICE_ID" \
  '(.device // (.devices[] | select(.id==$id))).name')"
topic="$(echo "$devices_json" | jq -r --argjson id "$DEVICE_ID" \
  '(.device // (.devices[] | select(.id==$id))).topic')"
[[ "$topic" == restrict/*/config ]] || die "unexpected device topic: $topic"

# The device token is the middle topic level; its password is in clients.env.
token="${topic#restrict/}"; token="${token%/config}"
password="$(awk -F'\t' -v t="$topic" '$3==t {print $2}' "$CLIENTS_FILE" | head -1)"
[[ -n "$password" ]] || die "no broker account for $topic in $CLIENTS_FILE"

echo "device:   $device_name (id $DEVICE_ID)"
echo "topic:    $topic"
echo "service:  $SERVICE_URL"

WORK="$(mktemp -d)"
SUB_NAME="verify-phase8-sub-$$"
cleanup() {
  timeout 20 docker rm -f "$SUB_NAME" >/dev/null 2>&1 || true
  rm -rf "$WORK"
  # Leave the device as we found it: no lock from this proof.
  timeout 20 curl -sS -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
    -d '{}' "$SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/unlock" >/dev/null 2>&1 || true
}
trap cleanup EXIT

# A real subscriber on the device's own TLS credentials. %U is a Unix timestamp
# with sub-second precision, so the receipt can be measured on the same clock.
: > "$WORK/sub.log"
timeout 60 docker run --rm -d --name "$SUB_NAME" --network host \
  -v "$PWD/$CA_FILE:/tls/ca.crt:ro" -v "$WORK:/out" \
  --entrypoint sh "$MQTT_IMAGE" -c \
  "exec mosquitto_sub -h 127.0.0.1 -p 8883 --cafile /tls/ca.crt \
     -u '$token' -P '$password' -t '$topic' -F '%U|%t|%p' > /out/sub.log 2>/out/sub.err" \
  >/dev/null

# The retained config arrives at once, so its arrival proves the subscriber is
# connected and will see the lock.
for _ in $(seq 1 100); do
  [[ -s "$WORK/sub.log" ]] && break
  sleep 0.1
done
[[ -s "$WORK/sub.log" ]] || die "subscriber never received the retained config: $(cat "$WORK/sub.err" 2>/dev/null)"
before_lines="$(wc -l < "$WORK/sub.log")"
echo "retained before lock:"
tail -1 "$WORK/sub.log" | cut -c1-160

# Issue the lock and time it.
t0="$(date +%s.%N)"
http="$(curl -sS -o "$WORK/resp.json" -w '%{http_code} %{time_total}' \
  -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"minutes":30}' "$SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/lock")"
t_after_curl="$(date +%s.%N)"

# Wait for the new retained message to reach the subscriber.
for _ in $(seq 1 100); do
  [[ "$(wc -l < "$WORK/sub.log")" -gt "$before_lines" ]] && break
  sleep 0.01
done
t_after_recv="$(date +%s.%N)"
received="$(tail -1 "$WORK/sub.log")"
t_recv="$(echo "$received" | cut -d'|' -f1)"

lat="$(awk -v a="$t0" -v b="$t_recv" 'BEGIN { printf "%.0f", (b-a)*1000 }')"
wall="$(awk -v a="$t0" -v b="$t_after_recv" 'BEGIN { printf "%.0f", (b-a)*1000 }')"

echo
echo "request:  POST $SERVICE_URL/api/v1/admin/devices/$DEVICE_ID/lock {\"minutes\":30}"
echo "response: HTTP $(echo "$http" | cut -d' ' -f1) after $(echo "$http" | cut -d' ' -f2) s"
echo "          $(cat "$WORK/resp.json")"
echo
echo "delivered: $received"
echo
echo "LATENCY (request -> subscriber receipt): ${lat} ms"
echo "LATENCY (upper bound, poll included):    ${wall} ms"

if [[ "$lat" -ge 1000 ]]; then
  die "lock took ${lat} ms, which is not under one second"
fi
echo "PASS: lock reached the device in ${lat} ms"