#!/bin/bash
# Common library for QA regression scripts.
# Source this from any test script: . "$(dirname "$0")/../common/lib.sh"

set -uo pipefail

# ---------- env ----------
HOST="${HOST:-https://d2ivgwliouoia2.cloudfront.net}"
ADMIN_USER="${ADMIN_USER:-admin@example.invalid}"
ADMIN_PW="${ADMIN_PW:-Admin123!}"
CLIENT_ID="${CLIENT_ID:-nexuscrm-ui}"
CLIENT_SECRET="${CLIENT_SECRET:-nexuscrm-ui-internal}"
API_VERSION="${API_VERSION:-v63.0}"

QA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
RESULTS_DIR="${RESULTS_DIR:-$QA_DIR/results/_adhoc}"
mkdir -p "$RESULTS_DIR"

# Token cache — token persists across script invocations within same RESULTS_DIR
ADMIN_TOKEN_FILE="$RESULTS_DIR/.admin_tok"
SALES_TOKEN_FILE="$RESULTS_DIR/.sales_tok"
FIXTURE_FILE="$RESULTS_DIR/fixture.json"
ENV_SNAPSHOT_FILE="$RESULTS_DIR/env_snapshot.json"

# ---------- auth ----------
get_admin_token() {
  if [ -f "$ADMIN_TOKEN_FILE" ] && [ $(($(date +%s) - $(stat -f %m "$ADMIN_TOKEN_FILE" 2>/dev/null || stat -c %Y "$ADMIN_TOKEN_FILE"))) -lt 1500 ]; then
    cat "$ADMIN_TOKEN_FILE"
    return
  fi
  local resp tok
  resp=$(curl -s -X POST "$HOST/services/oauth2/token" \
    --data-urlencode "grant_type=password" \
    --data-urlencode "client_id=$CLIENT_ID" \
    --data-urlencode "client_secret=$CLIENT_SECRET" \
    --data-urlencode "username=$ADMIN_USER" \
    --data-urlencode "password=$ADMIN_PW")
  tok=$(echo "$resp" | python3 -c "import json,sys; print(json.load(sys.stdin).get('access_token',''))" 2>/dev/null)
  if [ -z "$tok" ]; then
    echo "ERROR: admin token failed: $resp" >&2
    return 1
  fi
  echo "$tok" > "$ADMIN_TOKEN_FILE"
  echo "$tok"
}

get_sales_token() {
  # Sales user is built by setup_fixture.sh; password stored in fixture.json
  if [ ! -f "$FIXTURE_FILE" ]; then
    echo "ERROR: no fixture — run common/setup_fixture.sh first" >&2
    return 1
  fi
  if [ -f "$SALES_TOKEN_FILE" ] && [ $(($(date +%s) - $(stat -f %m "$SALES_TOKEN_FILE" 2>/dev/null || stat -c %Y "$SALES_TOKEN_FILE"))) -lt 1500 ]; then
    cat "$SALES_TOKEN_FILE"
    return
  fi
  local user pw resp tok
  user=$(python3 -c "import json; print(json.load(open('$FIXTURE_FILE'))['sales']['username'])")
  pw=$(python3 -c "import json; print(json.load(open('$FIXTURE_FILE'))['sales']['password'])")
  resp=$(curl -s -X POST "$HOST/services/oauth2/token" \
    --data-urlencode "grant_type=password" \
    --data-urlencode "client_id=$CLIENT_ID" \
    --data-urlencode "client_secret=$CLIENT_SECRET" \
    --data-urlencode "username=$user" \
    --data-urlencode "password=$pw")
  tok=$(echo "$resp" | python3 -c "import json,sys; print(json.load(sys.stdin).get('access_token',''))" 2>/dev/null)
  if [ -z "$tok" ]; then
    echo "ERROR: sales token failed: $resp" >&2
    return 1
  fi
  echo "$tok" > "$SALES_TOKEN_FILE"
  echo "$tok"
}

# ---------- api helpers ----------
api_query() {
  local tok="$1"; local soql="$2"
  curl -s -G "$HOST/services/data/$API_VERSION/query" \
    --data-urlencode "q=$soql" \
    -H "Authorization: Bearer $tok"
}

api_get() {
  local tok="$1"; local path="$2"
  curl -s "$HOST/services/data/$API_VERSION$path" -H "Authorization: Bearer $tok"
}

api_post() {
  local tok="$1"; local path="$2"; local body="$3"
  curl -s -X POST "$HOST/services/data/$API_VERSION$path" \
    -H "Authorization: Bearer $tok" -H "Content-Type: application/json" \
    -d "$body"
}

api_patch_status() {
  local tok="$1"; local path="$2"; local body="$3"
  curl -s -o /dev/null -w "%{http_code}" -X PATCH "$HOST/services/data/$API_VERSION$path" \
    -H "Authorization: Bearer $tok" -H "Content-Type: application/json" \
    -d "$body"
}

api_status() {
  local tok="$1"; local method="$2"; local path="$3"
  curl -s -o /dev/null -w "%{http_code}" -X "$method" "$HOST/services/data/$API_VERSION$path" \
    -H "Authorization: Bearer $tok"
}

# ---------- verdict emission ----------
# Usage: emit_verdict <story> <ac> <verdict> "<evidence>"
# Verdict ∈ {PASS, FAIL, BLOCKED, INCONCLUSIVE}.
# Prints JSON to stdout AND appends to $RESULTS_DIR/results.jsonl.
# Inputs are passed via env vars (not heredoc interpolation) so evidence with
# arbitrary shell-special characters, triple-quotes, newlines, etc. is safe.
emit_verdict() {
  local build_lm
  build_lm=$(curl -sI "$HOST/" 2>/dev/null | grep -i "last-modified" | sed 's/^[Ll]ast-[Mm]odified: //' | tr -d '\r\n')
  EMIT_STORY="$1" EMIT_AC="$2" EMIT_VERDICT="$3" EMIT_EVIDENCE="${4:-}" \
    EMIT_BUILD="$build_lm" EMIT_TS="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
    EMIT_RESULTS_FILE="$RESULTS_DIR/results.jsonl" \
    python3 -c "
import json, os
out = {
  'story': os.environ['EMIT_STORY'],
  'ac': os.environ['EMIT_AC'],
  'verdict': os.environ['EMIT_VERDICT'],
  'build_last_modified': os.environ['EMIT_BUILD'],
  'ts': os.environ['EMIT_TS'],
  'evidence': os.environ['EMIT_EVIDENCE'],
}
line = json.dumps(out)
print(line)
with open(os.environ['EMIT_RESULTS_FILE'], 'a') as f:
    f.write(line + '\n')
"
}

# ---------- env snapshot ----------
# Capture staging env state once per run (for cross-run diff attribution).
record_env_snapshot() {
  if [ -f "$ENV_SNAPSHOT_FILE" ]; then return; fi
  local tok build_lm etag
  tok=$(get_admin_token) || return
  build_lm=$(curl -sI "$HOST/" 2>/dev/null | grep -i "last-modified" | sed 's/^[Ll]ast-[Mm]odified: //' | tr -d '\r\n')
  etag=$(curl -sI "$HOST/" 2>/dev/null | grep -i "etag" | sed 's/^[Ee][Tt][Aa][Gg]: //' | tr -d '\r\n')
  python3 -c "
import json
print(json.dumps({
  'host': '$HOST',
  'api_version': '$API_VERSION',
  'build_last_modified': '''$build_lm''',
  'bundle_etag': '''$etag''',
  'recorded_at': '$(date -u +%Y-%m-%dT%H:%M:%SZ)',
}, indent=2))
" > "$ENV_SNAPSHOT_FILE"
}