#!/usr/bin/env bash
# ---------------------------------------------------------------
# Integration-test helper for OPC UA discovery.
#
# Usage:  tests/run_test.sh <config_dir> <expected_policy>
#
#   config_dir       — directory containing server_lds.conf,
#                      server_register.conf, server_register_client.conf,
#                      client.conf
#   expected_policy  — security-policy string that must appear in
#                      the client's endpoint listing (e.g.
#                      "Basic256Sha256", "Aes128_Sha256_RsaOaep",
#                      or "None")
#
# Exit: 0 when all checks pass, 1 on any failure.
# ---------------------------------------------------------------
set -uo pipefail
# NOTE: we intentionally omit "set -e" so that every check runs
# even if the client itself returns non-zero.

CONFIG_DIR="${1:?Usage: $0 <config_dir> <expected_policy>}"
EXPECTED_POLICY="${2:?Usage: $0 <config_dir> <expected_policy>}"

LDS_PORT=14840
SR_PORT=14841
LDS_PID=""
SR_PID=""
TMPFILE=""
FAILURES=0

# ── ensure certificates exist ─────────────────────────────────
CERT_DIR=certs
GEN_CERT=tools/generate_certificate.sh

for identity in ServerLDS ServerRegister ServerRegisterClient Client; do
  if [ ! -f "$CERT_DIR/${identity}_cert.der" ]; then
    "$GEN_CERT" "$CERT_DIR" "$identity"
  fi
done

# Populate trust stores: each identity trusts every other identity.
for store in server_lds server_register server_register_client client; do
  mkdir -p "$CERT_DIR/trust/$store"
  for identity in ServerLDS ServerRegister ServerRegisterClient Client; do
    cert="$CERT_DIR/${identity}_cert.der"
    [ -f "$cert" ] && cp -n "$cert" "$CERT_DIR/trust/$store/"
  done
done

# ── cleanup ────────────────────────────────────────────────────
cleanup() {
  [ -n "$LDS_PID" ] && kill "$LDS_PID" 2>/dev/null && wait "$LDS_PID" 2>/dev/null
  [ -n "$SR_PID" ] && kill "$SR_PID" 2>/dev/null && wait "$SR_PID" 2>/dev/null
  [ -n "$TMPFILE" ] && rm -f "$TMPFILE"
}
trap cleanup EXIT

# ── helpers ────────────────────────────────────────────────────
wait_for_port() {
  local port="$1" pid="$2" label="$3" i=0
  while [ $i -lt 50 ]; do
    if ! kill -0 "$pid" 2>/dev/null; then
      echo "FAIL: $label exited prematurely"
      exit 1
    fi
    if ss -tlnp 2>/dev/null | grep -q ":${port} "; then
      return 0
    fi
    sleep 0.1
    i=$((i + 1))
  done
  echo "FAIL: $label did not listen on port $port within 5 s"
  exit 1
}

# ── port check ─────────────────────────────────────────────────
for port in $LDS_PORT $SR_PORT; do
  if ss -tlnp 2>/dev/null | grep -q ":${port} "; then
    echo "FAIL: port $port is already in use"
    exit 1
  fi
done

# ── start LDS ──────────────────────────────────────────────────
build/ServerLDS "$CONFIG_DIR/server_lds.conf" >/dev/null 2>&1 &
LDS_PID=$!
wait_for_port "$LDS_PORT" "$LDS_PID" "ServerLDS"

# ── start ServerRegister ───────────────────────────────────────
build/ServerRegister "$CONFIG_DIR/server_register.conf" "$CONFIG_DIR/server_register_client.conf" "opc.tcp://localhost:$LDS_PORT" >/dev/null 2>&1 &
SR_PID=$!
wait_for_port "$SR_PORT" "$SR_PID" "ServerRegister"

# ── validation helper ─────────────────────────────────────────
check() {
  local label="$1" result="$2"
  if [ "$result" -eq 0 ]; then
    echo "PASS: $label"
  else
    echo "FAIL: $label"
    FAILURES=$((FAILURES + 1))
  fi
}

# ── FindServers ───────────────────────────────────────────────
TMPFILE=$(mktemp)
build/Client "$CONFIG_DIR/client.conf" find-servers "opc.tcp://localhost:$LDS_PORT" >"$TMPFILE" 2>&1
FS_RC=$?
FS_OUTPUT=$(<"$TMPFILE")

[ "$FS_RC" -eq 0 ]
check "find-servers exit code is 0 (got $FS_RC)" $?

echo "$FS_OUTPUT" | grep -q "urn:localhost:bobink:ServerRegister"
check "find-servers contains urn:localhost:bobink:ServerRegister" $?

# ── GetEndpoints ──────────────────────────────────────────────
build/Client "$CONFIG_DIR/client.conf" get-endpoints "opc.tcp://localhost:$SR_PORT" >"$TMPFILE" 2>&1
GE_RC=$?
GE_OUTPUT=$(<"$TMPFILE")

[ "$GE_RC" -eq 0 ]
check "get-endpoints exit code is 0 (got $GE_RC)" $?

echo "$GE_OUTPUT" | grep -q "$EXPECTED_POLICY"
check "get-endpoints contains $EXPECTED_POLICY" $?

# ── ReadTime ──────────────────────────────────────────────────
build/Client "$CONFIG_DIR/client.conf" read-time "opc.tcp://localhost:$SR_PORT" >"$TMPFILE" 2>&1
RT_RC=$?
RT_OUTPUT=$(<"$TMPFILE")

[ "$RT_RC" -eq 0 ]
check "read-time exit code is 0 (got $RT_RC)" $?

echo "$RT_OUTPUT" | grep -q "date is:"
check "read-time output contains 'date is:'" $?

# ── result ─────────────────────────────────────────────────────
if [ "$FAILURES" -ne 0 ]; then
  echo ""
  echo "--- find-servers output ---"
  echo "$FS_OUTPUT"
  echo "--- get-endpoints output ---"
  echo "$GE_OUTPUT"
  echo "--- read-time output ---"
  echo "$RT_OUTPUT"
  echo "--- end ---"
  exit 1
fi
exit 0