#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
API_URL="${AIHR_PERSONAL_API_URL:-https://wygj-api.localhost}"
QDRANT_URL="${AIHR_QDRANT_URL:-http://127.0.0.1:6333}"
QDRANT_COLLECTION="${AIHR_PERSONAL_QDRANT_COLLECTION:-aihr_personal_knowledge}"
DB_CONTAINER="${AIHR_DB_CONTAINER:-wygj-mysql}"
DB_NAME="${AIHR_DB_NAME:-ry-vue}"
REDIS_CONTAINER="${AIHR_REDIS_CONTAINER:-wygj-redis}"
DOCKER_NETWORK="${AIHR_DOCKER_NETWORK:-wygj_default}"
PHONE_A="13900009111"
PHONE_B="13900009222"
SMS_CODE="${AIHR_SMS_DEV_CODE:-123456}"
TITLE="personal-assistant-smoke-isolation"
CONTENT="个人助理隔离烟测唯一标记，物业催费沟通资料。"

TOKEN_A=""
CLIENT_A=""
TOKEN_B=""
CLIENT_B=""
USER_A=""
USER_B=""
ITEM_ID=""

fail() { echo "FAIL: $*" >&2; exit 1; }
need() { command -v "$1" >/dev/null 2>&1 || fail "missing command: $1"; }
expect_code() {
  local actual="$1" expected="$2" label="$3"
  [[ "$actual" == "$expected" ]] || fail "$label expected=$expected actual=$actual"
}

mysql() {
  docker exec "$DB_CONTAINER" mysql -uroot -proot --default-character-set=utf8mb4 -N -B -D "$DB_NAME" -e "$1" 2>/dev/null
}

cleanup() {
  local exit_code=$?
  local oss_rows oss_id object_key
  set +e
  [[ -n "$USER_A" ]] || USER_A="$(mysql "select user_id from sys_user where phonenumber='$PHONE_A' order by user_id desc limit 1" | head -1)"
  [[ -n "$USER_B" ]] || USER_B="$(mysql "select user_id from sys_user where phonenumber='$PHONE_B' order by user_id desc limit 1" | head -1)"
  for uid in "$USER_A" "$USER_B"; do
    [[ "$uid" =~ ^[0-9]+$ ]] || continue
    curl -fsS -X POST "$QDRANT_URL/collections/$QDRANT_COLLECTION/points/delete?wait=true" \
      -H 'Content-Type: application/json' \
      --data "{\"filter\":{\"must\":[{\"key\":\"tenant_id\",\"match\":{\"value\":\"000000\"}},{\"key\":\"owner_user_id\",\"match\":{\"value\":$uid}}]}}" >/dev/null 2>&1 || true
  done
  oss_rows="$(mysql "select o.oss_id,o.file_name from sys_oss o join aihr_personal_item i on i.oss_id=o.oss_id where i.title='$TITLE' and i.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0))" || true)"
  while IFS=$'\t' read -r oss_id object_key; do
    [[ "$oss_id" =~ ^[0-9]+$ && -n "$object_key" ]] || continue
    docker run --rm --network "$DOCKER_NETWORK" --entrypoint /bin/sh minio/mc -c \
      "mc alias set local http://wygj-minio:9000 ruoyi ruoyi123 >/dev/null && mc rm --force 'local/ruoyi/$object_key' >/dev/null" \
      >/dev/null 2>&1 || true
    mysql "delete from sys_oss where oss_id=$oss_id and file_name='$object_key'" >/dev/null 2>&1 || true
  done <<<"$oss_rows"
  mysql "
    delete f from aihr_personal_fragment f join aihr_personal_item i on i.id=f.item_id
      where i.title='$TITLE' and i.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete j from aihr_personal_cleanup_job j join aihr_personal_item i on i.id=j.item_id
      where i.title='$TITLE' and i.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete from aihr_personal_item where title='$TITLE'
      and owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete m from aihr_personal_chat_message m join aihr_personal_chat_session s on s.id=m.session_id
      where s.owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete from aihr_personal_chat_session
      where owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete from aihr_personal_space
      where owner_user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete from sys_user_role where user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete from sys_user_post where user_id in (coalesce(nullif('$USER_A',''),0),coalesce(nullif('$USER_B',''),0));
    delete from sys_user where phonenumber in ('$PHONE_A','$PHONE_B') and remark='移动端短信自动注册';
    delete from sys_logininfor where user_name in ('$PHONE_A','$PHONE_B');
  " >/dev/null 2>&1 || true
  docker exec "$REDIS_CONTAINER" redis-cli -a ruoyi123 DEL \
    "global:captcha_codes:$PHONE_A" "global:captcha_codes:$PHONE_B" >/dev/null 2>&1 || true
  for phone in "$PHONE_A" "$PHONE_B"; do
    docker exec "$REDIS_CONTAINER" sh -c \
      "redis-cli -a ruoyi123 --scan --pattern '*resource/sms/code:$phone*' 2>/dev/null | xargs -r redis-cli -a ruoyi123 DEL" \
      >/dev/null 2>&1 || true
  done
  return "$exit_code"
}
trap cleanup EXIT INT TERM

api() {
  local token="$1" client="$2" method="$3" path="$4" body="${5:-}"
  local args=(-kfsS -X "$method" "$API_URL$path" -H "Authorization: Bearer $token" -H "clientid: $client")
  [[ -z "$body" ]] || args+=(-H 'Content-Type: application/json' --data "$body")
  curl "${args[@]}"
}

login() {
  local phone="$1" response
  response="$(curl -kfsS "$API_URL/resource/sms/code?phonenumber=$phone")"
  expect_code "$(jq -r '.code' <<<"$response")" "200" "send sms code"
  response="$(curl -kfsS -X POST "$API_URL/auth/mobile/sms-login" -H 'Content-Type: application/json' \
    --data "{\"tenantId\":\"000000\",\"phonenumber\":\"$phone\",\"smsCode\":\"$SMS_CODE\"}")"
  expect_code "$(jq -r '.code' <<<"$response")" "200" "mobile sms login"
  jq -er '.data.access_token, .data.client_id' <<<"$response" | paste -sd ' ' -
}

need curl
need jq
need docker
curl -kfsS "$API_URL/auth/tenant/list" | jq -e '.code == 200' >/dev/null || fail "backend health is not UP: $API_URL"
docker ps --format '{{.Names}}' | grep -qx "$DB_CONTAINER" || fail "database container not running: $DB_CONTAINER"
docker ps --format '{{.Names}}' | grep -qx "$REDIS_CONTAINER" || fail "redis container not running: $REDIS_CONTAINER"
mysql "select 1 from aihr_personal_item limit 1" >/dev/null || fail "personal knowledge schema missing; run ./scripts/reset-dev-db.sh"

cleanup
read -r TOKEN_A CLIENT_A <<<"$(login "$PHONE_A")"
read -r TOKEN_B CLIENT_B <<<"$(login "$PHONE_B")"
USER_A="$(mysql "select user_id from sys_user where phonenumber='$PHONE_A' order by user_id desc limit 1")"
USER_B="$(mysql "select user_id from sys_user where phonenumber='$PHONE_B' order by user_id desc limit 1")"
[[ "$USER_A" =~ ^[0-9]+$ && "$USER_B" =~ ^[0-9]+$ && "$USER_A" != "$USER_B" ]] || fail "smoke users were not created independently"

created="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/items/text \
  "{\"title\":\"$TITLE\",\"content\":\"$CONTENT\",\"tags\":[\"smoke\"]}")"
expect_code "$(jq -r '.code' <<<"$created")" "200" "A create text item"
ITEM_ID="$(jq -er '.data.itemId' <<<"$created")"

for _ in {1..40}; do
  detail="$(api "$TOKEN_A" "$CLIENT_A" GET "/api/aihr/personal-assistant/items/$ITEM_ID")"
  [[ "$(jq -r '.data.status // empty' <<<"$detail")" == "READY" ]] && break
  sleep 1
done
expect_code "$(jq -r '.data.status // empty' <<<"$detail")" "READY" "A text item processing"
expect_code "$(jq -r '.data.title // empty' <<<"$detail")" "$TITLE" "A item detail"

search_a="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/search \
  "{\"queryText\":\"隔离烟测\",\"scope\":[\"PERSONAL\"],\"itemIds\":[$ITEM_ID],\"limit\":10}")"
expect_code "$(jq -r '.code' <<<"$search_a")" "200" "A search"
[[ "$(jq --arg item "$ITEM_ID" '[.data.hits[] | select((.itemId | tostring) == $item)] | length' <<<"$search_a")" -ge 1 ]] || {
  jq '{code,msg,data}' <<<"$search_a" >&2
  fail "A search did not return own item"
}

for operation in detail download retry delete; do
  case "$operation" in
    detail) response="$(api "$TOKEN_B" "$CLIENT_B" GET "/api/aihr/personal-assistant/items/$ITEM_ID" || true)" ;;
    download) response="$(api "$TOKEN_B" "$CLIENT_B" GET "/api/aihr/personal-assistant/items/$ITEM_ID/download-url" || true)" ;;
    retry) response="$(api "$TOKEN_B" "$CLIENT_B" POST "/api/aihr/personal-assistant/items/$ITEM_ID/retry" || true)" ;;
    delete) response="$(api "$TOKEN_B" "$CLIENT_B" DELETE "/api/aihr/personal-assistant/items/$ITEM_ID" || true)" ;;
  esac
  expect_code "$(jq -r '.msg // empty' <<<"$response")" "PERSONAL_ITEM_NOT_FOUND" "B $operation A item"
done

search_b="$(api "$TOKEN_B" "$CLIENT_B" POST /api/aihr/personal-assistant/search \
  "{\"queryText\":\"隔离烟测\",\"scope\":[\"PERSONAL\"],\"itemIds\":[$ITEM_ID],\"limit\":10}")"
expect_code "$(jq -r '.code' <<<"$search_b")" "200" "B itemIds search"
expect_code "$(jq '.data.hits | length' <<<"$search_b")" "0" "B itemIds search isolation"

for blocked_url in 'http://127.0.0.1/admin' 'http://169.254.169.254/latest/meta-data/'; do
  response="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/items/url \
    "{\"url\":\"$blocked_url\",\"title\":\"$TITLE\"}" || true)"
  expect_code "$(jq -r '.msg // empty' <<<"$response")" "PERSONAL_URL_BLOCKED" "SSRF $blocked_url"
done

deleted1="$(api "$TOKEN_A" "$CLIENT_A" DELETE "/api/aihr/personal-assistant/items/$ITEM_ID")"
deleted2="$(api "$TOKEN_A" "$CLIENT_A" DELETE "/api/aihr/personal-assistant/items/$ITEM_ID")"
expect_code "$(jq -r '.code' <<<"$deleted1")" "200" "A delete"
expect_code "$(jq -r '.data.cleanupJobId' <<<"$deleted2")" "$(jq -r '.data.cleanupJobId' <<<"$deleted1")" "idempotent delete job"
response="$(api "$TOKEN_A" "$CLIENT_A" GET "/api/aihr/personal-assistant/items/$ITEM_ID" || true)"
expect_code "$(jq -r '.msg // empty' <<<"$response")" "PERSONAL_ITEM_NOT_FOUND" "A item hidden immediately"
response="$(api "$TOKEN_A" "$CLIENT_A" POST /api/aihr/personal-assistant/search \
  "{\"queryText\":\"隔离烟测\",\"scope\":[\"PERSONAL\"],\"itemIds\":[$ITEM_ID],\"limit\":10}")"
expect_code "$(jq '.data.hits | length' <<<"$response")" "0" "deleted item search"

echo "PASS: personal assistant isolation, SSRF, readiness and deletion gates"