#!/usr/bin/env bash
# =============================================================================
# creds-test.sh — gum-powered interactive probe of the credentials shared by
# SMTP and PeerTube in the xamxam database.
#
# Probes two endpoints with the SAME stored username/password, going directly
# (bypassing any SSO portal):
#   • SMTP      — TCP connect + SMTP AUTH + disconnect (no mail sent)
#   • PeerTube  — OAuth2 "password" grant against <instance>/api/v1/users/token
#
# Every run is appended to a log without the plaintext password.
#
# Usage:
#   scripts/creds-test.sh [--db <path>] [--instance <url>] [--channel <handle>]
#     --instance / --channel  override the stored values for the PeerTube probe
#     --show-pwd              reveal the decrypted password (interactive confirm)
#
# Exit code 0 => both probes succeeded; 1 => at least one failed.
# =============================================================================
set -uo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
PROBE="$SCRIPT_DIR/creds-probe.php"
LOG="$SCRIPT_DIR/../creds-test.log"

DB_PATH=""
INSTANCE=""
CHANNEL=""
SHOW_PWD=0

# ---- argument parsing --------------------------------------------------------
while [[ $# -gt 0 ]]; do
  case "$1" in
    --db)        DB_PATH="$2";   shift 2 ;;
    --instance)  INSTANCE="$2";  shift 2 ;;
    --channel)   CHANNEL="$2";   shift 2 ;;
    --show-pwd)  SHOW_PWD=1;     shift   ;;
    -h|--help)
      gum style "Usage:" --bold
      gum style "  scripts/creds-test.sh [--db <path>] [--instance <url>] [--channel <handle>] [--show-pwd]"
      exit 0 ;;
    *) echo "Unknown arg: $1" >&2; exit 2 ;;
  esac
done

# ---- preflight ---------------------------------------------------------------
command -v gum >/dev/null || { echo "gum is required (install via 'brew install gum' or the repo justfile)"; exit 2; }
command -v php  >/dev/null || { echo "php is required"; exit 2; }
[[ -f "$PROBE" ]] || { echo "Missing helper: $PROBE"; exit 2; }

gum style "── XAMXAM · probe SMTP vs PeerTube ────────────────────────" \
  --border double --padding "1 2" --foreground 212

# Default DB path: same layout as the PHP helpers.
DB_PATH="${DB_PATH:-$REPO_ROOT/app/storage/xamxam.db}"
if [[ ! -f "$DB_PATH" ]]; then
  gum style "✗ Database not found: $DB_PATH" --foreground 196
  exit 2
fi

PROBE_ARGS=(--db "$DB_PATH")
[[ -n "$INSTANCE" ]] && PROBE_ARGS+=(--instance "$INSTANCE")
[[ -n "$CHANNEL"  ]] && PROBE_ARGS+=(--channel "$CHANNEL")
if [[ "$SHOW_PWD" -eq 1 ]]; then
  # Interactive confirmation BEFORE we ever print a password.
  if gum confirm "Show the decrypted password on screen? (it will NOT be logged)"; then
    PROBE_ARGS+=(--with-pwd)
  else
    exit 130
  fi
fi

# ---- run the probe ---------------------------------------------------------------
OUT="$(gum spin --spinner minidot --title "Probing SMTP + PeerTube …" \
  -- php "$PROBE" "${PROBE_ARGS[@]}" 2>/tmp/creds-probe.err)"
RC=$?
if [[ -n "${OUT:-}" ]]; then
  JSON="$OUT"
else
  JSON='{}'
fi

# ---- decode ------------------------------------------------------------------
username=$(php -r 'echo json_decode($argv[1],true)["username"]??"";' "$JSON")
smtp_ok=$(php -r 'echo (json_decode($argv[1],true)["smtp"]["ok"]??false)?"1":"0";' "$JSON")
smtp_err=$(php -r 'echo json_decode($argv[1],true)["smtp"]["error"]??"";' "$JSON")
ptv_ok=$(php -r 'echo (json_decode($argv[1],true)["peertube"]["ok"]??false)?"1":"0";' "$JSON")
ptv_err=$(php -r 'echo json_decode($argv[1],true)["peertube"]["error"]??"";' "$JSON")

# ---- render with gum ---------------------------------------------------------
gum style "Username : $username" --foreground 214
[[ "$SHOW_PWD" -eq 1 ]] && gum style "Password : $(php -r 'echo json_decode($argv[1],true)["password"]??"";' "$JSON")" --foreground 214

gum style "SMTP" --padding "0 1" --foreground 240 --bold
if [[ "$smtp_ok" == "1" ]]; then
  gum style "  ✓ SMTP AUTH succeeded (connect + auth + close, no mail sent)" --foreground 42
else
  gum style "  ✗ SMTP failed: ${smtp_err}" --foreground 196
fi

gum style "PeerTube (direct OAuth password grant, no portal)" --padding "0 1" --foreground 240 --bold
if [[ "$ptv_ok" == "1" ]]; then
  gum style "  ✓ PeerTube issued an access token with these creds" --foreground 42
else
  gum style "  ✗ PeerTube failed: ${ptv_err}" --foreground 196
fi

# ---- verdict + log -------------------------------------------------------------
verdict="UNKNOWN"
if [[ "$ptv_ok" == "1" ]]; then verdict="PEERTUBE_TOKENS_OK"; fi
status_line="$verdict"
if [[ "$ptv_ok" == "0" && "$smtp_ok" == "1" ]]; then
  status_line="SMTP_OK__PEERTUBE_BAD"
  gum style "" --foreground 214
  gum style "  Root-cause hint:" --foreground 214 --bold
  gum style "  Credentials are valid (SMTP auth works), but PeerTube's password" --foreground 214
  gum style "  grant rejects them → the SSO/portal almost certainly broke PeerTube's" --foreground 214
  gum style "  direct API password-grant path, even though the same login works" --foreground 214
  gum style "  through portail.erg.be. See the curl repro in the PHP helper/todo." --foreground 214
elif [[ "$ptv_ok" == "0" && "$smtp_ok" == "0" ]]; then
  status_line="BOTH_BAD"
  gum style "  Both probes failed → the stored credentials themselves are wrong/stale." --foreground 214
elif [[ "$ptv_ok" == "1" && "$smtp_ok" == "1" ]]; then
  status_line="BOTH_OK"
  gum style "  Both SMTP and PeerTube accept these credentials." --foreground 42
fi

# ---- append to log (NEVER the password) -----------------------------------------
{
  echo "===== $(date '+%Y-%m-%d %H:%M:%S') | $status_line | user=$username | db=$DB_PATH"
  echo "  SMTP        : ok=$smtp_ok err=$(printf '%q' "$smtp_err")"
  echo "  PeerTube    : ok=$ptv_ok err=$(printf '%q' "$ptv_err")"
} >> "$LOG"
gum style "" --foreground 240
gum style "Logged (no password stored) → $LOG" --foreground 240

# Exit 0 only when BOTH probes succeeded.
[[ "$smtp_ok" == "1" && "$ptv_ok" == "1" ]] && exit 0 || exit 1