#!/bin/bash
# تست کامل احراز هویت میک اسمارت هوم — captcha → register → login → admin → password change
BASE="http://localhost:3000"
JAR="/tmp/mik-test-cookies.txt"
rm -f "$JAR"
TESTPHONE="0912$(date +%s | tail -c 8)"
echo "test phone: $TESTPHONE"
PASS=0; FAIL=0
ck() { if [ "$1" = "$2" ]; then echo "✅ $3"; PASS=$((PASS+1)); else echo "❌ $3 (got: $1, want: $2)"; FAIL=$((FAIL+1)); fi; }

echo "== 1. captcha =="
CAP=$(curl -s "$BASE/api/auth/captcha")
TOKEN=$(echo "$CAP" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
A=$(echo "$CAP" | python3 -c "import sys,json; print(json.load(sys.stdin)['a'])")
B=$(echo "$CAP" | python3 -c "import sys,json; print(json.load(sys.stdin)['b'])")
SUM=$((A+B))
echo "   captcha: $A + $B = $SUM"

echo "== 2. ثبت‌نام با کپچای غلط → باید 400 =="
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/api/auth/register" -H "Content-Type: application/json" \
  -d "{\"phone\":\"$TESTPHONE\",\"password\":\"test1234\",\"name\":\"کاربر تست\",\"captchaToken\":\"$TOKEN\",\"captchaAnswer\":99}")
ck "$CODE" "400" "register wrong-captcha rejected"

echo "== 3. ثبت‌نام با کپچای درست → 200 =="
CODE=$(curl -s -c "$JAR" -o /tmp/reg.json -w "%{http_code}" -X POST "$BASE/api/auth/register" -H "Content-Type: application/json" \
  -d "{\"phone\":\"$TESTPHONE\",\"password\":\"test1234\",\"name\":\"کاربر تست\",\"captchaToken\":\"$TOKEN\",\"captchaAnswer\":$SUM}")
ck "$CODE" "200" "register ok"

echo "== 4. me با کوکی ثبت‌نام =="
ME=$(curl -s -b "$JAR" "$BASE/api/auth/me")
echo "$ME" | rg -q "$TESTPHONE" && R="y" || R="n"; ck "$R" "y" "session cookie works after register"

echo "== 5. خروج =="
CODE=$(curl -s -b "$JAR" -c "$JAR" -o /dev/null -w "%{http_code}" -X POST "$BASE/api/auth/logout")
ck "$CODE" "200" "logout ok"

echo "== 6. ورود با رمز غلط → 401 =="
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/api/auth/login" -H "Content-Type: application/json" \
  -d "{\"phone\":\"$TESTPHONE\",\"password\":\"wrongpass\",\"captchaToken\":\"$TOKEN\",\"captchaAnswer\":$SUM}")
ck "$CODE" "401" "login wrong-password rejected"

echo "== 7. ورود درست → 200 =="
CODE=$(curl -s -c "$JAR" -o /tmp/login.json -w "%{http_code}" -X POST "$BASE/api/auth/login" -H "Content-Type: application/json" \
  -d "{\"phone\":\"$TESTPHONE\",\"password\":\"test1234\",\"captchaToken\":\"$TOKEN\",\"captchaAnswer\":$SUM}")
ck "$CODE" "200" "login ok"

echo "== 8. ورود ادمین 09120000000 / MikAdmin@1404 =="
rm -f /tmp/admin-jar.txt
CODE=$(curl -s -c /tmp/admin-jar.txt -o /tmp/admin-login.json -w "%{http_code}" -X POST "$BASE/api/auth/login" -H "Content-Type: application/json" \
  -d "{\"phone\":\"09120000000\",\"password\":\"MikAdmin@1404\",\"captchaToken\":\"$TOKEN\",\"captchaAnswer\":$SUM}")
ck "$CODE" "200" "admin login ok"
ISADMIN=$(python3 -c "import json; print(json.load(open('/tmp/admin-login.json')).get('user',{}).get('isAdmin'))" 2>/dev/null)
ck "$ISADMIN" "True" "admin flag true"

echo "== 9. دسترسی به پنل ادمین با کوکی =="
CODE=$(curl -s -b /tmp/admin-jar.txt -o /dev/null -w "%{http_code}" "$BASE/admin")
ck "$CODE" "200" "/admin accessible for admin"

echo "== 10. admin API (analytics) =="
CODE=$(curl -s -b /tmp/admin-jar.txt -o /dev/null -w "%{http_code}" "$BASE/api/admin/analytics")
ck "$CODE" "200" "/api/admin/analytics ok"

echo "== 10b. کاربر عادی نباید admin API ببیند =="
CODE=$(curl -s -b "$JAR" -o /dev/null -w "%{http_code}" "$BASE/api/admin/analytics")
ck "$CODE" "403" "user blocked from admin API"

echo "== 10c. صفحه فاکتور =="
CODE=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/invoice/1001")
ck "$CODE" "200" "/invoice/1001 renders"
CODE=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/api/invoice/1001")
ck "$CODE" "200" "/api/invoice/1001 ok"

echo "== 12. تغییر رمز از پروفایل =="
CODE=$(curl -s -b "$JAR" -o /dev/null -w "%{http_code}" -X PUT "$BASE/api/auth/profile" -H "Content-Type: application/json" \
  -d '{"currentPassword":"test1234","newPassword":"newpass99"}')
ck "$CODE" "200" "password change ok"

echo "== 13. ورود با رمز جدید =="
CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/api/auth/login" -H "Content-Type: application/json" \
  -d "{\"phone\":\"$TESTPHONE\",\"password\":\"newpass99\",\"captchaToken\":\"$TOKEN\",\"captchaAnswer\":$SUM}")
ck "$CODE" "200" "login with new password ok"

echo "== 14. admin-hint حذف شده باشد → 404 =="
CODE=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/api/auth/admin-hint")
ck "$CODE" "404" "admin-hint removed"

echo ""
echo "RESULT: PASS=$PASS FAIL=$FAIL"