#!/bin/bash

# Test authentication deployment
# This script tests the enhanced auth without affecting production

set -e

echo "=== Testing Authentication Deployment ==="
echo ""

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration
API_URL="http://localhost:3001/api"
TEST_USER="admin"
TEST_PASS="wrong-password"

echo -e "${BLUE}This script will test the authentication system${NC}"
echo "It will make failed login attempts to test lockout"
echo ""

# Check if server is running
echo -e "${BLUE}Checking server status...${NC}"
if curl -s -f "$API_URL/../health" > /dev/null; then
    echo -e "${GREEN}✓ Server is running${NC}"
else
    echo -e "${RED}✗ Server not accessible at $API_URL${NC}"
    exit 1
fi

# Function to make login attempt
make_login_attempt() {
    local username=$1
    local password=$2
    local expected_status=$3
    
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL/auth/admin/login" \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$username\",\"password\":\"$password\"}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    
    if [ "$http_code" -eq "$expected_status" ]; then
        echo -e "${GREEN}✓${NC} Got expected status $http_code"
        return 0
    else
        echo -e "${RED}✗${NC} Expected $expected_status, got $http_code"
        echo "Response: $body"
        return 1
    fi
}

# Test 1: Normal failed login
echo -e "\n${BLUE}Test 1: Normal failed login${NC}"
make_login_attempt "$TEST_USER" "$TEST_PASS" 401

# Test 2: Multiple failed attempts (testing lockout)
echo -e "\n${BLUE}Test 2: Testing account lockout (5 attempts)${NC}"
echo "Making 4 more failed attempts..."

for i in {2..5}; do
    echo -n "Attempt $i: "
    make_login_attempt "$TEST_USER" "$TEST_PASS" 401
    sleep 1
done

# Test 3: 6th attempt should be locked
echo -e "\n${BLUE}Test 3: 6th attempt (should be locked if enhanced auth active)${NC}"
echo -n "Attempt 6: "

response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL/auth/admin/login" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"$TEST_USER\",\"password\":\"$TEST_PASS\"}")

http_code=$(echo "$response" | tail -n1)
body=$(echo "$response" | head -n-1)

if [ "$http_code" -eq "423" ]; then
    echo -e "${GREEN}✓ Account locked as expected!${NC}"
    echo -e "${GREEN}Enhanced auth is ACTIVE${NC}"
    echo "Lockout message: $(echo $body | jq -r '.error')"
    ENHANCED_ACTIVE=true
elif [ "$http_code" -eq "401" ]; then
    echo -e "${YELLOW}! Still got 401 - Enhanced auth NOT active${NC}"
    echo "Original auth is still in use"
    ENHANCED_ACTIVE=false
else
    echo -e "${RED}✗ Unexpected status: $http_code${NC}"
    echo "Response: $body"
fi

# Test 4: Check if we can query login attempts
echo -e "\n${BLUE}Test 4: Checking login attempts table${NC}"

if [ "$ENHANCED_ACTIVE" = true ]; then
    # This would need database access, so we'll check via API behavior
    echo -e "${GREEN}✓ Login tracking is active${NC}"
else
    echo -e "${YELLOW}! Login tracking not active (migrations might not be run)${NC}"
fi

# Test 5: Test logout endpoint
echo -e "\n${BLUE}Test 5: Testing logout endpoint${NC}"

# First need a valid token (this assumes you have one for testing)
# For now, just check if endpoint exists
logout_response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL/auth/logout" \
    -H "Authorization: Bearer invalid-token")

logout_code=$(echo "$logout_response" | tail -n1)

if [ "$logout_code" -eq "200" ] || [ "$logout_code" -eq "401" ]; then
    echo -e "${GREEN}✓ Logout endpoint exists${NC}"
else
    echo -e "${YELLOW}! Logout endpoint might not be active${NC}"
fi

# Summary
echo -e "\n${BLUE}=== Summary ===${NC}"
if [ "$ENHANCED_ACTIVE" = true ]; then
    echo -e "${GREEN}✅ Enhanced authentication is ACTIVE${NC}"
    echo "- Account lockout protection: Working"
    echo "- Login attempt tracking: Active"
    echo "- Enhanced security: Enabled"
    echo ""
    echo -e "${YELLOW}Note: Test account might be locked for 30 minutes${NC}"
else
    echo -e "${YELLOW}⚠️  Enhanced authentication is NOT ACTIVE${NC}"
    echo "- Using original auth system"
    echo "- No lockout protection"
    echo "- No login tracking"
    echo ""
    echo "To activate:"
    echo "1. Run migrations: docker exec wedding-photo-sharing-backend-1 npx knex migrate:latest"
    echo "2. Update server.js to use auth-enhanced routes"
    echo "3. Restart: docker-compose restart backend"
fi

echo ""
echo "Test complete!"