#!/usr/bin/env bash
# Spec 037-DNS-VIEWER — smoke tests pós-deploy ou pós-rollback
# VM122: API corre em container Docker — após rsync host, docker cp + restart (ver DNS-VIEWER-EXEC)
set -euo pipefail

HOST="10.10.10.122"
LEGACY_ONLY=0
DOMAIN="${DNS_TEST_DOMAIN:-ligbox.com.br}"

usage() {
  echo "Usage: $0 [--host IP] [--legacy-only] [--domain NAME]"
  exit 1
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --host) HOST="$2"; shift 2 ;;
    --legacy-only) LEGACY_ONLY=1; shift ;;
    --domain) DOMAIN="$2"; shift 2 ;;
    -h|--help) usage ;;
    *) echo "Unknown: $1"; usage ;;
  esac
done

API="http://${HOST}:8080"
FE="http://${HOST}:8091"
FAIL=0

check() {
  local name="$1"
  local code="$2"
  local expect="$3"
  if [[ "$code" == "$expect" ]]; then
    echo "  OK  $name → HTTP $code"
  else
    echo "  FAIL $name → HTTP $code (expected $expect)"
    FAIL=1
  fi
}

echo "=== DNS Viewer verify — $HOST domain=$DOMAIN ==="

CODE=$(curl -sS -o /dev/null -w '%{http_code}' "${API}/health" 2>/dev/null || echo "000")
check "API /health" "$CODE" "200"

CODE=$(curl -sS -o /dev/null -w '%{http_code}' "${FE}/" 2>/dev/null || echo "000")
check "Frontend /" "$CODE" "200"

# Sem auth — endpoints devem 401/403, não 500
CODE=$(curl -sS -o /dev/null -w '%{http_code}' \
  "${API}/api/v1/dns/cloudflare/records?domain=${DOMAIN}" 2>/dev/null || echo "000")
if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then
  echo "  OK  legacy CF records (no auth) → HTTP $CODE"
elif [[ "$CODE" == "200" ]]; then
  echo "  OK  legacy CF records → HTTP 200 (auth bypass/local?)"
else
  echo "  FAIL legacy CF records → HTTP $CODE (expected 401/403/200)"
  FAIL=1
fi

if [[ "$LEGACY_ONLY" -eq 0 ]]; then
  CODE=$(curl -sS -o /dev/null -w '%{http_code}' \
    "${API}/api/v1/dns/viewer/${DOMAIN}" 2>/dev/null || echo "000")
  if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then
    echo "  OK  dns/viewer (no auth) → HTTP $CODE"
  elif [[ "$CODE" == "200" ]]; then
    echo "  OK  dns/viewer → HTTP 200"
  elif [[ "$CODE" == "404" ]]; then
    echo "  WARN dns/viewer → 404 (DNS_VIEWER_ENABLED=0 ou não deployado)"
  else
    echo "  FAIL dns/viewer → HTTP $CODE"
    FAIL=1
  fi

  CODE=$(curl -sS -o /dev/null -w '%{http_code}' \
    "${API}/api/v1/domain-console/dns/viewer/${DOMAIN}" 2>/dev/null || echo "000")
  if [[ "$CODE" == "401" || "$CODE" == "403" ]]; then
    echo "  OK  domain-console/dns/viewer (no auth) → HTTP $CODE"
  elif [[ "$CODE" == "200" ]]; then
    echo "  OK  domain-console/dns/viewer → HTTP 200"
  elif [[ "$CODE" == "404" ]]; then
    echo "  WARN domain-console/dns/viewer → 404 (router não deployado)"
  else
    echo "  FAIL domain-console/dns/viewer → HTTP $CODE"
    FAIL=1
  fi
fi

# JS assets existem
for f in app.js dns-viewer.js; do
  CODE=$(curl -sS -o /dev/null -w '%{http_code}' "${FE}/assets/${f}" 2>/dev/null || echo "000")
  if [[ "$f" == "dns-viewer.js" && "$CODE" == "404" ]]; then
    echo "  WARN assets/${f} → 404 (V1b não deployado — OK se legacy-only)"
  else
    check "assets/${f}" "$CODE" "200"
  fi
done

echo ""
if [[ "$FAIL" -eq 0 ]]; then
  echo "=== Verify PASSED ==="
  exit 0
else
  echo "=== Verify FAILED — ver DNS-VIEWER-ROLLBACK.md ==="
  exit 1
fi