#!/bin/bash
# Polleo Demand — post-deploy smoke test.
#
# Usage:
#   bash smoke_test.sh                              # localhost (dev)
#   bash smoke_test.sh https://nabava.polleosport.com  # production
#
# Requires: curl, jq
# Exits 0 if all checks pass, 1 otherwise.

set -eu
BASE="${1:-http://localhost:8000}"
USERNAME="${SMOKE_USER:-lovro}"
PASSWORD="${SMOKE_PW:-Lovro2575}"

# Strip trailing slash
BASE="${BASE%/}"
API="${BASE}/api"

PASS=0
FAIL=0

check() {
    local name="$1" cmd="$2"
    printf "  %-50s " "$name"
    if eval "$cmd" > /tmp/smoke.last 2>&1; then
        echo "✓"
        PASS=$((PASS + 1))
    else
        echo "✗ FAIL"
        echo "    ----- output -----"
        sed 's/^/    /' /tmp/smoke.last
        echo "    -----"
        FAIL=$((FAIL + 1))
    fi
}

if ! command -v jq >/dev/null; then
    echo "ERROR: jq not installed. Install via: apt install jq  /  yum install jq"
    exit 1
fi

echo
echo "============================================================"
echo "Polleo Demand smoke test"
echo "  Target:   $BASE"
echo "  Username: $USERNAME"
echo "============================================================"
echo

# 1. Health (no auth)
check "GET /api/health" \
      "curl -fsS '${API}/health' | jq -e '.status==\"ok\" and .db==\"connected\"'"

# 2. Login
TOKEN=$(curl -fsS -X POST "${API}/auth/login" \
        -H 'Content-Type: application/json' \
        -d "{\"username\":\"${USERNAME}\",\"password\":\"${PASSWORD}\"}" \
        | jq -r .token)
if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
    echo "  POST /api/auth/login                              ✗ FAIL"
    echo "    Could not extract token — check username/password"
    FAIL=$((FAIL + 1))
else
    echo "  POST /api/auth/login                              ✓"
    PASS=$((PASS + 1))
fi

# 3. /api/auth/me with token
check "GET /api/auth/me" \
      "curl -fsS '${API}/auth/me' -H 'Authorization: Bearer $TOKEN' | jq -e '.username==\"$USERNAME\"'"

# 4. /api/auth/me/sections returns the section list
check "GET /api/auth/me/sections" \
      "curl -fsS '${API}/auth/me/sections' -H 'Authorization: Bearer $TOKEN' | jq -e '.sections | length > 0'"

# 5. 401 without token
check "GET /api/auth/me (no token) → 401" \
      "curl -fsS -o /dev/null -w '%{http_code}' '${API}/auth/me' | grep -q '^401$'"

# 6. 401 with bad token
check "GET /api/auth/me (bad token) → 401" \
      "curl -fsS -o /dev/null -w '%{http_code}' '${API}/auth/me' -H 'Authorization: Bearer bogus' | grep -q '^401$'"

# 7. Sample protected endpoint — supply health
check "GET /api/supply/health" \
      "curl -fsS '${API}/supply/health' -H 'Authorization: Bearer $TOKEN' | jq -e '.status==\"ok\"'"

# 8. Frontend reachable (only checks 200)
check "GET / (frontend root)" \
      "curl -fsS -o /dev/null -w '%{http_code}' '${BASE}/' | grep -q '^200$'"

# Cleanup
rm -f /tmp/smoke.last

echo
echo "============================================================"
echo "Results: ${PASS} passed, ${FAIL} failed"
echo "============================================================"

if [ "$FAIL" -gt 0 ]; then
    exit 1
fi
exit 0