#!/usr/bin/env bash

set -Eeuo pipefail

dhv2_base_url="${DHV2_BASE_URL:-https://dhv2.korexlabs.com}"
dhv2_base_url="${dhv2_base_url%/}"
dhv2_nil_uuid="00000000-0000-4000-8000-000000000000"

fail() {
  echo "ERROR: $*" >&2
  exit 1
}

echo "========== C2 · MIGRACIONES =========="
dhv2_migration_status="$(docker compose --profile tools run --rm migrate npm run migration:show 2>&1)"
grep -q 'Pending migrations: no' <<<"$dhv2_migration_status" \
  || fail "Quedaron migraciones pendientes"
echo "Migraciones pendientes: no"

echo
echo "========== C2 · HEALTH =========="
dhv2_internal="$(curl -fsS --connect-timeout 10 --max-time 30 http://127.0.0.1:3101/api/v3/health)"
dhv2_external="$(curl -fsS --connect-timeout 10 --max-time 30 "$dhv2_base_url/api/v3/health")"
grep -q '"version":"0.14.0"' <<<"$dhv2_internal" || fail "Health interno no informa v0.14.0"
grep -q '"phase":"C2"' <<<"$dhv2_internal" || fail "Health interno no informa C2"
grep -q '"version":"0.14.0"' <<<"$dhv2_external" || fail "Health externo no informa v0.14.0"
grep -q '"database":"ok"' <<<"$dhv2_external" || fail "La base no está saludable"
echo "$dhv2_external"

echo
echo "========== C2 · RUTA PROTEGIDA =========="
dhv2_code="$(curl -sS --connect-timeout 10 --max-time 30 \
  -o /tmp/dhv2-c2-response.json -w '%{http_code}' \
  "$dhv2_base_url/api/v3/survey-campaign-targets/$dhv2_nil_uuid/report")"
test "$dhv2_code" = "401" \
  || fail "/api/v3/survey-campaign-targets/:id/report devolvió HTTP $dhv2_code; se esperaba 401"
rm -f /tmp/dhv2-c2-response.json
echo "/api/v3/survey-campaign-targets/:id/report sin sesión: 401 OK"

echo
echo "========== C2 · MODELO Y PERMISOS =========="
dhv2_db_check="$(docker compose exec -T db sh -lc \
  'psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" -v ON_ERROR_STOP=1 -v app_user="$APP_DB_USER" -At' <<'SQL'
SELECT 'tables', COUNT(*)
FROM information_schema.tables
WHERE table_schema = 'public'
  AND table_name IN (
    'survey_target_reports',
    'survey_target_report_media',
    'survey_target_report_versions'
  );

SELECT 'submitted_status', COUNT(*)
FROM pg_constraint
WHERE conname = 'chk_survey_campaign_targets_status'
  AND pg_get_constraintdef(oid) LIKE '%SUBMITTED%';

SELECT 'report_checks', COUNT(*)
FROM pg_constraint
WHERE conname IN (
  'chk_survey_target_reports_outcome',
  'chk_survey_target_reports_status',
  'chk_survey_target_reports_coordinates',
  'chk_survey_target_reports_accuracy',
  'chk_survey_target_report_versions_event'
);

SELECT 'report_per_target', COUNT(*)
FROM pg_constraint
WHERE conname = 'uq_survey_target_reports_target_id';

SELECT 'immutable_version_identity', COUNT(*)
FROM pg_constraint
WHERE conname = 'uq_survey_target_report_versions_number';

SELECT 'permissions', COUNT(*)
FROM permissions
WHERE code IN ('surveys.read_reports', 'surveys.capture', 'surveys.review');

SELECT 'read_roles', COUNT(*)
FROM role_permissions role_permission
INNER JOIN roles role ON role.id = role_permission.role_id
INNER JOIN permissions permission ON permission.id = role_permission.permission_id
WHERE role.code IN ('admin', 'director', 'supervisor', 'inspector', 'auditor')
  AND permission.code = 'surveys.read_reports';

SELECT 'capture_roles', COUNT(*)
FROM role_permissions role_permission
INNER JOIN roles role ON role.id = role_permission.role_id
INNER JOIN permissions permission ON permission.id = role_permission.permission_id
WHERE role.code IN ('admin', 'supervisor', 'inspector')
  AND permission.code = 'surveys.capture';

SELECT 'review_roles', COUNT(*)
FROM role_permissions role_permission
INNER JOIN roles role ON role.id = role_permission.role_id
INNER JOIN permissions permission ON permission.id = role_permission.permission_id
WHERE role.code IN ('admin', 'director', 'supervisor')
  AND permission.code = 'surveys.review';

SELECT 'app_reports_select', has_table_privilege(:'app_user', 'survey_target_reports', 'SELECT');
SELECT 'app_reports_update', has_table_privilege(:'app_user', 'survey_target_reports', 'UPDATE');
SELECT 'app_reports_delete', has_table_privilege(:'app_user', 'survey_target_reports', 'DELETE');
SELECT 'app_versions_insert', has_table_privilege(:'app_user', 'survey_target_report_versions', 'INSERT');
SELECT 'app_versions_update', has_table_privilege(:'app_user', 'survey_target_report_versions', 'UPDATE');
SELECT 'app_versions_delete', has_table_privilege(:'app_user', 'survey_target_report_versions', 'DELETE');
SQL
)"
grep -q 'tables|3' <<<"$dhv2_db_check" || fail "Faltan tablas de ejecución"
grep -q 'submitted_status|1' <<<"$dhv2_db_check" || fail "El objetivo no admite el estado de revisión"
grep -q 'report_checks|5' <<<"$dhv2_db_check" || fail "Faltan controles de integridad"
grep -q 'report_per_target|1' <<<"$dhv2_db_check" || fail "No se garantiza un informe actual por objetivo"
grep -q 'immutable_version_identity|1' <<<"$dhv2_db_check" || fail "No se garantiza la identidad de versiones"
grep -q 'permissions|3' <<<"$dhv2_db_check" || fail "No se crearon los tres permisos C2"
grep -q 'read_roles|5' <<<"$dhv2_db_check" || fail "Faltan roles de lectura"
grep -q 'capture_roles|3' <<<"$dhv2_db_check" || fail "Faltan roles de captura"
grep -q 'review_roles|3' <<<"$dhv2_db_check" || fail "Faltan roles de revisión"
grep -q 'app_reports_select|t' <<<"$dhv2_db_check" || fail "La API no puede leer informes"
grep -q 'app_reports_update|t' <<<"$dhv2_db_check" || fail "La API no puede actualizar informes"
grep -q 'app_reports_delete|f' <<<"$dhv2_db_check" || fail "La API no debe borrar informes físicamente"
grep -q 'app_versions_insert|t' <<<"$dhv2_db_check" || fail "La API no puede congelar versiones"
grep -q 'app_versions_update|f' <<<"$dhv2_db_check" || fail "La API no debe alterar versiones congeladas"
grep -q 'app_versions_delete|f' <<<"$dhv2_db_check" || fail "La API no debe borrar versiones congeladas"
echo "$dhv2_db_check"

echo
echo "========== C2 · FRONTEND =========="
docker compose exec -T web sh -lc \
  'grep -R "0.14.0" /usr/share/nginx/html/assets >/dev/null && grep -R "Ejecución y validación de relevamientos" /usr/share/nginx/html/assets >/dev/null && grep -R "Informe de campo" /usr/share/nginx/html/assets >/dev/null && grep -R "Capturar GPS actual" /usr/share/nginx/html/assets >/dev/null && grep -R "VERSIONES INMUTABLES" /usr/share/nginx/html/assets >/dev/null'
echo "Ejecución, GPS, versiones inmutables y footer v0.14.0: OK"

echo
echo "ACEPTACIÓN DE FASE C2: OK"