#!/usr/bin/env bash
set -euo pipefail

# Smoke tests for the API Gateway routing and auth.
#
# Usage:
#   ./scripts/smoke-test-gateway.sh                                        # Test local Docker gateway
#   ./scripts/smoke-test-gateway.sh https://api.coda.theorchard.io         # Test deployed gateway
#   GATEWAY_TOKEN=<jwt> ./scripts/smoke-test-gateway.sh <url>              # With auth token

GATEWAY_URL="${1:-http://localhost:8443}"
TOKEN="${GATEWAY_TOKEN:-}"
PASS=0
FAIL=0

check() {
  local desc="$1" expected="$2" actual="$3"
  if [[ "$actual" == "$expected" ]]; then
    echo "  PASS: $desc (got $actual)"
    ((PASS++))
  else
    echo "  FAIL: $desc (expected $expected, got $actual)"
    ((FAIL++))
  fi
}

echo "Gateway: $GATEWAY_URL"
echo ""

# ── Health (no auth) ─────────────────────────────────────────────────
echo "Health checks:"
status=$(curl -s -o /dev/null -w "%{http_code}" "$GATEWAY_URL/health")
check "GET /health" "200" "$status"

status=$(curl -s -o /dev/null -w "%{http_code}" "$GATEWAY_URL/health/ready")
check "GET /health/ready" "200" "$status"

# ── Routing (verify requests reach correct service) ──────────────────
echo ""
echo "Routing checks:"

auth_args=()
if [[ -n "$TOKEN" ]]; then
  auth_args=(-H "Authorization: Bearer $TOKEN")
fi

# Core → Server (via $default / fallback)
status=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST "$GATEWAY_URL/coda.core.v1.ChatService/ListChats" \
  -H "Content-Type: application/json" \
  "${auth_args[@]}" \
  -d '{}' 2>/dev/null) || status="000"
if [[ "$status" != "000" ]]; then
  echo "  PASS: POST /coda.core.v1.ChatService/* routed (got $status)"
  ((PASS++))
else
  echo "  FAIL: POST /coda.core.v1.ChatService/* — connection refused"
  ((FAIL++))
fi

# Search → Search
status=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST "$GATEWAY_URL/coda.search.v1.SearchService/SearchGraphQL" \
  -H "Content-Type: application/json" \
  "${auth_args[@]}" \
  -d '{"query": "test", "limit": 1}' 2>/dev/null) || status="000"
if [[ "$status" != "000" ]]; then
  echo "  PASS: POST /coda.search.v1.SearchService/* routed (got $status)"
  ((PASS++))
else
  echo "  FAIL: POST /coda.search.v1.SearchService/* — connection refused"
  ((FAIL++))
fi

# Admin → Platform
status=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST "$GATEWAY_URL/coda.admin.v1.AccessService/ListPolicies" \
  -H "Content-Type: application/json" \
  "${auth_args[@]}" \
  -d '{}' 2>/dev/null) || status="000"
if [[ "$status" != "000" ]]; then
  echo "  PASS: POST /coda.admin.v1.AccessService/* routed (got $status)"
  ((PASS++))
else
  echo "  FAIL: POST /coda.admin.v1.AccessService/* — connection refused"
  ((FAIL++))
fi

# ── Auth rejection (deployed gateway only) ───────────────────────────
if [[ "$GATEWAY_URL" != "http://localhost"* ]]; then
  echo ""
  echo "Auth checks (deployed gateway):"
  status=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "$GATEWAY_URL/coda.core.v1.ChatService/ListChats" \
    -H "Content-Type: application/json" \
    -d '{}')
  check "POST without token → 401" "401" "$status"
fi

# ── Summary ──────────────────────────────────────────────────────────
echo ""
echo "Results: $PASS passed, $FAIL failed"
[[ "$FAIL" -eq 0 ]] && exit 0 || exit 1