test

#!/usr/bin/env bash
# Live integration tests against a running proxy
set -uo pipefail

cd "$(dirname "$0")"

command -v yq >/dev/null 2>&1 || {
  echo "ERROR: yq v4+ is required" >&2
  exit 1
}

URL="${1:-http://localhost:${VAULT_PORT:-8282}}"
AUTH_HEADER="$(yq -r '.auth.header // "X-Agent-Token"' config.yaml)"

pass=0
fail=0
skip=0

preflight_code="$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$URL/" 2>/dev/null || true)"
if [[ -z "$preflight_code" ]]; then
  preflight_code="000"
fi
if [[ "$preflight_code" == "000" ]]; then
  echo "FAIL: proxy unreachable at $URL"
  exit 1
fi

in_set() {
  local needle="$1"
  shift
  local item
  for item in "$@"; do
    [[ "$needle" == "$item" ]] && return 0
  done
  return 1
}

assert_code() {
  local expected_csv="$1"
  local method="$2"
  local path="$3"
  local desc="$4"
  shift 4

  local code
  code="$(curl -s -o /dev/null -w "%{http_code}" -X "$method" --max-time 10 "$@" "$URL$path" 2>/dev/null || true)"
  [[ -n "$code" ]] || code="000"

  IFS=',' read -r -a expected <<<"$expected_csv"
  if in_set "$code" "${expected[@]}"; then
    printf 'PASS: %-4s %-40s -> %s  %s\n' "$method" "$path" "$code" "$desc"
    pass=$((pass + 1))
  else
    printf 'FAIL: %-4s %-40s -> %s  %s (expected %s)\n' "$method" "$path" "$code" "$desc" "$expected_csv"
    fail=$((fail + 1))
  fi
}

resolve_token() {
  local raw="$1"
  if [[ "$raw" =~ ^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$ ]]; then
    local var_name="${BASH_REMATCH[1]}"
    local value="${!var_name:-}"
    echo "$value"
  else
    echo "$raw"
  fi
}

check_enum_overrides_render() {
  local found=0
  local api
  local -a APIS=()
  mapfile -t APIS < <(yq -r '.apis | keys | .[]' config.yaml)
  for api in "${APIS[@]}"; do
    local policy
    local -a POLICIES=()
    mapfile -t POLICIES < <(yq -r ".apis.$api.policies | keys | .[]" config.yaml)
    for policy in "${POLICIES[@]}"; do
      local rendered=".generated/specs/${api}-${policy}.yaml"

      # Check team_scope (backward-compat)
      local has_team_scope
      has_team_scope="$(yq -r ".apis.$api.policies.$policy | has(\"team_scope\")" config.yaml)"
      if [[ "$has_team_scope" == "true" ]]; then
        found=1

        if [[ ! -f "$rendered" ]]; then
          echo "FAIL: missing rendered spec for team_scope policy $api/$policy ($rendered)"
          fail=$((fail + 1))
          continue
        fi

        local cfg_field
        cfg_field="$(yq -r ".apis.$api.policies.$policy.team_scope.field // \"team_assignee_id\"" config.yaml)"
        local spec_field
        spec_field="$(yq -r '.components.schemas.TeamFilterEquals.properties.field.enum[0] // ""' "$rendered")"
        if [[ "$cfg_field" == "$spec_field" ]]; then
          echo "PASS: team_scope field rendered for $api/$policy"
          pass=$((pass + 1))
        else
          echo "FAIL: team_scope field mismatch for $api/$policy (config=$cfg_field, spec=$spec_field)"
          fail=$((fail + 1))
        fi

        local cfg_ids
        cfg_ids="$(yq -r ".apis.$api.policies.$policy.team_scope.allowed_ids // [] | join(\",\")" config.yaml)"
        local spec_ids
        spec_ids="$(yq -r '.components.schemas.AllowedTeamId.enum // [] | join(",")' "$rendered")"
        if [[ "$cfg_ids" == "$spec_ids" ]]; then
          echo "PASS: team_scope ids rendered for $api/$policy"
          pass=$((pass + 1))
        else
          echo "FAIL: team_scope ids mismatch for $api/$policy (config=$cfg_ids, spec=$spec_ids)"
          fail=$((fail + 1))
        fi
      fi

      # Check enum_overrides (generic)
      local has_overrides
      has_overrides="$(yq -r ".apis.$api.policies.$policy | has(\"enum_overrides\")" config.yaml)"
      if [[ "$has_overrides" == "true" ]]; then
        found=1

        if [[ ! -f "$rendered" ]]; then
          echo "FAIL: missing rendered spec for enum_overrides policy $api/$policy ($rendered)"
          fail=$((fail + 1))
          continue
        fi

        local override_key
        while IFS= read -r override_key; do
          [[ -n "$override_key" ]] || continue
          local spec_path=".components.schemas.${override_key//\./.}"

          local cfg_vals
          cfg_vals="$(yq -r ".apis.$api.policies.$policy.enum_overrides[\"$override_key\"].values // [] | join(\",\")" config.yaml)"
          local spec_vals
          spec_vals="$(yq -r "$spec_path.enum // [] | join(\",\")" "$rendered")"
          if [[ "$cfg_vals" == "$spec_vals" ]]; then
            echo "PASS: enum_overrides[$override_key] values rendered for $api/$policy"
            pass=$((pass + 1))
          else
            echo "FAIL: enum_overrides[$override_key] values mismatch for $api/$policy (config=$cfg_vals, spec=$spec_vals)"
            fail=$((fail + 1))
          fi
        done < <(yq -r ".apis.$api.policies.$policy.enum_overrides // {} | keys | .[]" config.yaml)
      fi
    done
  done

  if [[ "$found" == "0" ]]; then
    echo "SKIP: no team_scope or enum_overrides policy configured"
    skip=$((skip + 1))
  fi
}

echo "== Agent API Firewall live tests =="
echo "URL: $URL"

root_code="$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$URL/unknown" 2>/dev/null || true)"
[[ -n "$root_code" ]] || root_code="000"
if [[ "$root_code" == "404" ]]; then
  echo "PASS: unknown route returns 404"
  pass=$((pass + 1))
else
  echo "FAIL: unknown route expected 404, got $root_code"
  fail=$((fail + 1))
fi

check_enum_overrides_render

mapfile -t AGENTS < <(yq -r '.agents | keys | .[]' config.yaml)

first_agent=""
first_api=""
first_token=""

for agent in "${AGENTS[@]}"; do
  token_raw="$(yq -r ".agents.$agent.token // \"\"" config.yaml)"
  token_value="$(resolve_token "$token_raw")"

  access_count="$(yq -r ".agents.$agent.access | length" config.yaml)"
  for ((idx = 0; idx < access_count; idx++)); do
    api="$(yq -r ".agents.$agent.access[$idx].api" config.yaml)"
    policy="$(yq -r ".agents.$agent.access[$idx].policy" config.yaml)"
    spec="$(yq -r ".apis.$api.policies.$policy.spec // \"\"" config.yaml)"

    probe_path="/$agent/$api/_probe"

    assert_code "401" GET "$probe_path" "missing token blocked" \
      -H "X-Agent-Firewall-Probe: 1"

    assert_code "401" GET "$probe_path" "wrong token blocked" \
      -H "$AUTH_HEADER: definitely-wrong-token" \
      -H "X-Agent-Firewall-Probe: 1"

    if [[ -n "$token_value" ]]; then
      assert_code "204" GET "$probe_path" "valid token accepted" \
        -H "$AUTH_HEADER: $token_value" \
        -H "X-Agent-Firewall-Probe: 1"

      if [[ -n "$spec" ]]; then
        assert_code "403" GET "/$agent/$api/this-path-should-be-blocked" "spec blocks unknown endpoint" \
          -H "$AUTH_HEADER: $token_value"
      fi
    else
      echo "SKIP: $agent/$api valid-token tests (token env not set for $token_raw)"
      skip=$((skip + 1))
    fi

    if [[ -z "$first_agent" && -n "$token_value" ]]; then
      first_agent="$agent"
      first_api="$api"
      first_token="$token_value"
    fi
  done
done

# Cross-agent isolation smoke test (if two tokens are available)
second_agent=""
second_api=""
for agent in "${AGENTS[@]}"; do
  token_raw="$(yq -r ".agents.$agent.token // \"\"" config.yaml)"
  token_value="$(resolve_token "$token_raw")"
  [[ -n "$token_value" ]] || continue
  [[ "$agent" == "$first_agent" ]] && continue

  second_agent="$agent"
  second_api="$(yq -r ".agents.$agent.access[0].api" config.yaml)"
  break
done

if [[ -n "$first_agent" && -n "$second_agent" ]]; then
  assert_code "401" GET "/$second_agent/$second_api/_probe" "agent token cannot access another agent route" \
    -H "$AUTH_HEADER: $first_token" \
    -H "X-Agent-Firewall-Probe: 1"
else
  echo "SKIP: cross-agent isolation test (need >=2 agents with resolved tokens)"
  skip=$((skip + 1))
fi

echo
echo "Result: $pass passed, $fail failed, $skip skipped"
[[ $fail -eq 0 ]]