#!/bin/sh
set -e

# Integration test runner for API gateway.
# Tests X-Service + X-Resource header routing against a gateway on localhost.
#
# Required env:
#   GW           — gateway base URL (e.g. http://localhost:8080)
#   RESULTS_DIR  — directory to write Tekton results

PASS=0; FAIL=0; TOTAL=0

assert() {
  NAME="$1"; EXPECT="$2"
  shift 2
  TOTAL=$((TOTAL + 1))
  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || echo "000")

  if [ "$CODE" = "$EXPECT" ]; then
    echo "  ✓ ${NAME} (${CODE})"
    PASS=$((PASS + 1))
  else
    echo "  ✗ ${NAME} — expected ${EXPECT}, got ${CODE}"
    FAIL=$((FAIL + 1))
  fi
}

# ── Wait for sidecar gateway ──
echo "⏳ Waiting for gateway sidecar..."
READY=false
for i in $(seq 1 60); do
  CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
  if [ "$CODE" = "200" ]; then
    sleep 1
    C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
    C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
    if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
      READY=true
      echo "✓ Gateway ready"
      break
    fi
  fi
  sleep 2
done

if [ "$READY" = "false" ]; then
  echo "✗ Gateway never became ready"
  echo "fail" > "${RESULTS_DIR}/result"
  echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
  exit 1
fi

echo ""
echo "═══ Integration Tests ═══"
echo ""

# ── Health ──
echo "▸ Health"
assert "GET /healthz" 200  -X GET "${GW}/healthz"
assert "GET /readyz"  200  -X GET "${GW}/readyz"

# ── Header validation ──
echo "▸ Header validation"
assert "X-Service without X-Resource → 400" 400 \
  -X GET -H "X-Service: memory" "${GW}/"
assert "unknown service → 404" 404 \
  -X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"

# ── S3 (no auth, MinIO rejects → 403) ──
echo "▸ S3 service"
assert "s3/list-objects" 403 \
  -X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"

# ── SQS (auth required → 401) ──
echo "▸ SQS service"
assert "sqs/list-queues" 401 \
  -X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"

# ── Workflow visibility (namespace pass-down) ──
echo "▸ Workflow service"

# Test 1: List workflows in poimen-harness namespace (should see 4 terminated workflows)
echo "  Testing workflow visibility in poimen-harness namespace..."
WF_LIST=$(curl -s -X POST \
  -H "X-Service: workflow" \
  -H "X-Resource: list" \
  -H "Content-Type: application/json" \
  -d '{"namespace": "poimen-harness"}' \
  "${GW}/" 2>/dev/null || echo '{}')

# Check if response contains workflows
if echo "$WF_LIST" | grep -q '"executions"'; then
  echo "  ✓ Workflow list returned (poimen-harness namespace)"
  PASS=$((PASS + 1))
else
  echo "  ✗ Workflow list failed to return executions"
  FAIL=$((FAIL + 1))
fi
TOTAL=$((TOTAL + 1))

# Test 2: Verify we can query terminated workflows
echo "  Testing terminated workflow visibility..."
if echo "$WF_LIST" | grep -q '"Completed\|"status"'; then
  echo "  ✓ Found completed/terminated workflows in response"
  PASS=$((PASS + 1))
else
  echo "  ⚠ No terminated workflows found in response (may be empty namespace)"
  # Don't fail if namespace is empty - just note it
fi
TOTAL=$((TOTAL + 1))

# Test 3: Verify namespace is required (missing namespace → 400)
echo "  Testing namespace validation..."
NO_NS=$(curl -s -w '%{http_code}' -X POST \
  -H "X-Service: workflow" \
  -H "X-Resource: list" \
  -H "Content-Type: application/json" \
  -d '{}' \
  "${GW}/" 2>/dev/null || echo "000")

if [ "$NO_NS" = "400" ]; then
  echo "  ✓ Correctly rejected list without namespace (400)"
  PASS=$((PASS + 1))
else
  echo "  ✗ Expected 400 for missing namespace, got $NO_NS"
  FAIL=$((FAIL + 1))
fi
TOTAL=$((TOTAL + 1))

echo ""
echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"

if [ "$FAIL" -eq 0 ]; then
  echo "pass" > "${RESULTS_DIR}/result"
else
  echo "fail" > "${RESULTS_DIR}/result"
fi
echo "${PASS}/${TOTAL} passed, ${FAIL} failed" > "${RESULTS_DIR}/summary"

[ "$FAIL" -eq 0 ]