#!/usr/bin/env bash
# test_auth.sh — тестирует аутентификацию:
#   - POST /console/api/auth (login endpoint)
#   - X-Auth-Token header (authMiddleware)
#   - Authorization: Bearer header
#   - DemoAuth: любая строка ≥6 символов
set -uo pipefail

ROOT_DIR=$(cd "$(dirname "$0")" && pwd)
source "${ROOT_DIR}/lib.sh"

NS_CLEANUP_SCRIPT="${ROOT_DIR}/cleanup_test_namespaces.sh"
RUN_ID=$(mk_run_id)
SUB="auth-test-${RUN_ID}@test.local"

cleanup() {
  if [ -x "$NS_CLEANUP_SCRIPT" ]; then
    KUBECTL_DIRECT=1 "$NS_CLEANUP_SCRIPT" "$SUB" >/dev/null 2>&1 || true
  fi
}
trap cleanup EXIT

echo ""
echo "========================================"
echo "  test_auth.sh  run=$RUN_ID"
echo "========================================"

# ── POST /auth ──────────────────────────────────────────────────────────────

echo ""
echo ">>> POST /auth: пустой токен → 400"
R=$(curl -s -w "\n%{http_code}" -X POST "${BASE}/auth" \
  -H "Content-Type: application/json" -d '{"token":""}')
check_http "$(echo "$R" | tail -1)" "400" "POST /auth пустой token → 400"

echo ""
echo ">>> POST /auth: токен < 6 символов → 401"
R=$(curl -s -w "\n%{http_code}" -X POST "${BASE}/auth" \
  -H "Content-Type: application/json" -d '{"token":"ab"}')
check_http "$(echo "$R" | tail -1)" "401" "POST /auth токен 2 символа → 401"

R=$(curl -s -w "\n%{http_code}" -X POST "${BASE}/auth" \
  -H "Content-Type: application/json" -d '{"token":"abcde"}')
check_http "$(echo "$R" | tail -1)" "401" "POST /auth токен 5 символов → 401"

echo ""
echo ">>> POST /auth: токен ≥6 символов → 200"
R=$(curl -s -w "\n%{http_code}" -X POST "${BASE}/auth" \
  -H "Content-Type: application/json" -d "{\"token\":\"${SUB}\"}")
CODE=$(echo "$R" | tail -1)
BODY=$(echo "$R" | sed '$d')
check_http "$CODE" "200" "POST /auth валидный токен → 200"
NS=$(json_field "$BODY" namespace)
printf '%s' "$NS" | grep -q '^fission-' && pass "POST /auth namespace=fission-..." || fail "POST /auth namespace format: $NS"
OK=$(json_field "$BODY" ok)
[ "$OK" = "True" ] || [ "$OK" = "true" ] && pass "POST /auth ok=true" || fail "POST /auth ok=$OK"

echo ""
echo ">>> POST /auth: невалидный JSON → 400"
R=$(curl -s -w "\n%{http_code}" -X POST "${BASE}/auth" \
  -H "Content-Type: application/json" -d 'not-json')
CODE=$(echo "$R" | tail -1)
[ "$CODE" = "400" ] && pass "POST /auth невалидный JSON → 400" || fail "POST /auth невалидный JSON → $CODE"

echo ""
echo ">>> POST /auth: GET метод → 405"
R=$(curl -s -w "\n%{http_code}" "${BASE}/auth")
CODE=$(echo "$R" | tail -1)
[ "$CODE" = "405" ] && pass "GET /auth → 405" || fail "GET /auth → $CODE"

# ── X-Auth-Token header ──────────────────────────────────────────────────────

echo ""
echo ">>> X-Auth-Token: отсутствует → 401"
R=$(curl -s -w "\n%{http_code}" "${BASE}/functions")
check_http "$(echo "$R" | tail -1)" "401" "GET /functions без токена → 401"

echo ""
echo ">>> X-Auth-Token: токен < 6 символов → 401"
R=$(curl -s -w "\n%{http_code}" "${BASE}/functions" -H "X-Auth-Token: ab")
check_http "$(echo "$R" | tail -1)" "401" "GET /functions токен 2 символа → 401"

R=$(curl -s -w "\n%{http_code}" "${BASE}/functions" -H "X-Auth-Token: abcde")
check_http "$(echo "$R" | tail -1)" "401" "GET /functions токен 5 символов → 401"

echo ""
echo ">>> X-Auth-Token: токен ≥6 символов → 200"
R=$(curl -s -w "\n%{http_code}" "${BASE}/functions" -H "X-Auth-Token: ${SUB}")
check_http "$(echo "$R" | tail -1)" "200" "GET /functions валидный X-Auth-Token → 200"

echo ""
echo ">>> Authorization: Bearer → 200"
R=$(curl -s -w "\n%{http_code}" "${BASE}/functions" \
  -H "Authorization: Bearer ${SUB}")
check_http "$(echo "$R" | tail -1)" "200" "GET /functions Authorization: Bearer → 200"

# ── Namespace детерминирован ─────────────────────────────────────────────────

echo ""
echo ">>> Namespace детерминирован (одинаковый токен → одинаковый NS)"
R1=$(curl -s -X POST "${BASE}/auth" -H "Content-Type: application/json" -d "{\"token\":\"${SUB}\"}")
R2=$(curl -s -X POST "${BASE}/auth" -H "Content-Type: application/json" -d "{\"token\":\"${SUB}\"}")
NS1=$(json_field "$R1" namespace)
NS2=$(json_field "$R2" namespace)
[ "$NS1" = "$NS2" ] && [ -n "$NS1" ] && pass "Namespace детерминирован: $NS1" || fail "Namespace не детерминирован: '$NS1' vs '$NS2'"

print_summary