#!/bin/bash
# Sprint 1 tests: #13 (httpOnly cookies, password recovery) + #6 (session TTL)
set -e
BASE="http://localhost:3099"
EMAIL="cookie-$(date +%s%N)@test.com"
PASS=0 FAIL=0 TOTAL=0

t() {
  TOTAL=$((TOTAL + 1))
  if echo "$3" | grep -q "$2"; then
    PASS=$((PASS + 1)); echo "  ✅ $1"
  else
    FAIL=$((FAIL + 1)); echo "  ❌ $1 (expected: $2, got: $3)"
  fi
}

echo "=== AUTH: httpOnly Cookie ==="

R=$(curl -s -c /tmp/c1.txt -w "\n%{http_code}" -X POST "$BASE/api/auth/signup" \
  -H 'Content-Type: application/json' -d "{\"name\":\"Test\",\"email\":\"$EMAIL\",\"password\":\"test123\"}")
CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
t "signup returns 201" "201" "$CODE"
t "signup returns token in body" "token" "$BODY"
COOKIE=$(grep bp_session /tmp/c1.txt 2>/dev/null | awk '{print $NF}')
t "signup sets httpOnly cookie" "ey" "$COOKIE"

R=$(curl -s -c /tmp/c2.txt -w "\n%{http_code}" -X POST "$BASE/api/auth/login" \
  -H 'Content-Type: application/json' -d "{\"email\":\"$EMAIL\",\"password\":\"test123\"}")
CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
t "login returns 200" "200" "$CODE"
t "login returns professional info" "name" "$BODY"
COOKIE2=$(grep bp_session /tmp/c2.txt 2>/dev/null | awk '{print $NF}')
t "login sets httpOnly cookie" "ey" "$COOKIE2"

R=$(curl -s -b /tmp/c2.txt -w "\n%{http_code}" "$BASE/api/auth/me")
t "GET /me with cookie auth" "200" "$(echo "$R" | tail -1)"

TOKEN=$(echo "$BODY" | grep -o '"token":"[^"]*"' | cut -d'"' -f4)
R=$(curl -s -w "\n%{http_code}" -H "Authorization: Bearer $TOKEN" "$BASE/api/auth/me")
t "GET /me with Bearer still works" "200" "$(echo "$R" | tail -1)"

R=$(curl -s -w "\n%{http_code}" -b /tmp/c2.txt -X POST "$BASE/api/auth/logout")
t "POST /logout returns 200" "200" "$(echo "$R" | tail -1)"

echo ""
echo "=== AUTH: Password Recovery ==="

R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/forgot-password" \
  -H 'Content-Type: application/json' -d "{\"email\":\"$EMAIL\"}")
CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
t "forgot-password returns 200" "200" "$CODE"
t "forgot-password message" "reset link was sent" "$BODY"

R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/forgot-password" \
  -H 'Content-Type: application/json' -d '{"email":"nonexistent@test.com"}')
CODE=$(echo "$R" | tail -1); BODY=$(echo "$R" | head -1)
t "forgot-password unknown email still 200" "200" "$CODE"
t "forgot-password doesn't reveal email existence" "reset link was sent" "$BODY"

RESET_TOKEN=$(grep "PASSWORD_RESET.*$EMAIL" /tmp/bp-server.log | tail -1 | sed 's/.*: \([a-f0-9]\{64\}\).*/\1/')
if [ -n "$RESET_TOKEN" ]; then
  t "reset token generated" "." "$RESET_TOKEN"

  R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/reset-password" \
    -H 'Content-Type: application/json' -d '{"token":"badtoken","password":"newpass123"}')
  t "reset-password bad token → 400" "400" "$(echo "$R" | tail -1)"

  R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/reset-password" \
    -H 'Content-Type: application/json' -d "{\"token\":\"$RESET_TOKEN\",\"password\":\"newpass123\"}")
  t "reset-password good token → 200" "200" "$(echo "$R" | tail -1)"

  R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/login" \
    -H 'Content-Type: application/json' -d "{\"email\":\"$EMAIL\",\"password\":\"newpass123\"}")
  t "login with new password works" "200" "$(echo "$R" | tail -1)"

  R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/login" \
    -H 'Content-Type: application/json' -d "{\"email\":\"$EMAIL\",\"password\":\"test123\"}")
  t "old password fails after reset" "401" "$(echo "$R" | tail -1)"
else
  echo "  ⚠️ Could not extract reset token (5 tests skipped)"
  TOTAL=$((TOTAL + 5))
fi

echo ""
echo "=== AUTH: Validation ==="

R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/signup" \
  -H 'Content-Type: application/json' -d '{"name":"X","email":"short@t.com","password":"12"}')
t "signup rejects short password" "400" "$(echo "$R" | tail -1)"

R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/login" \
  -H 'Content-Type: application/json' -d '{"email":"a@b.com"}')
t "login rejects missing password" "400" "$(echo "$R" | tail -1)"

R=$(curl -s -w "\n%{http_code}" -X POST "$BASE/api/auth/refresh" -H "Authorization: Bearer $TOKEN")
t "POST /refresh returns 200" "200" "$(echo "$R" | tail -1)"

echo ""
echo "=== SESSION TTL (#6) ==="

R=$(curl -s -H "Authorization: Bearer $TOKEN" "$BASE/api/agent/info")
t "agent/info returns session counts" "playground" "$R"

curl -s -H "Authorization: Bearer $TOKEN" -X POST "$BASE/api/agent/message" \
  -H 'Content-Type: application/json' -d '{"from":"ttl-test","message":"oi"}' > /dev/null 2>&1

R=$(curl -s -H "Authorization: Bearer $TOKEN" "$BASE/api/agent/info")
t "session count after message" "playground" "$R"

R=$(curl -s -w "\n%{http_code}" -H "Authorization: Bearer $TOKEN" -X POST "$BASE/api/agent/reset" \
  -H 'Content-Type: application/json' -d '{"from":"ttl-test","channel":"playground"}')
t "agent/reset returns 200" "200" "$(echo "$R" | tail -1)"

echo ""
echo "=== RESULTS ==="
echo "Total: $TOTAL | Pass: $PASS | Fail: $FAIL"
[ "$FAIL" -eq 0 ] && echo "🟢 ALL PASS" || echo "🔴 $FAIL FAILURES"
rm -f /tmp/c1.txt /tmp/c2.txt
