#!/bin/bash
set -uo pipefail
PASS=0
FAIL=0

check() {
  if [ "$1" = "$2" ]; then
    PASS=$((PASS+1))
    echo "PASS: $3 (got: $1)"
  else
    FAIL=$((FAIL+1))
    echo "FAIL: $3 -- expected [$2] got [$1]"
  fi
}

contains() {
  if echo "$1" | grep -q "$2"; then
    PASS=$((PASS+1))
    echo "PASS: $3"
  else
    FAIL=$((FAIL+1))
    echo "FAIL: $3 -- did not find '$2'"
  fi
}

echo "=== 1. Start MariaDB and load fresh schema ==="
service mariadb start 2>&1 | tail -1
sleep 2
mysql -u root -e "DROP DATABASE IF EXISTS fete; CREATE DATABASE fete;"
mysql -u root fete < /home/claude/fete/database/schema.sql
mysql -u root -e "CREATE USER IF NOT EXISTS 'fete_user'@'127.0.0.1' IDENTIFIED BY 'testpass123'; GRANT ALL PRIVILEGES ON fete.* TO 'fete_user'@'127.0.0.1'; FLUSH PRIVILEGES;"
echo "schema loaded"

echo "=== 2. Start PHP dev server ==="
cd /home/claude/fete/public
php -S 127.0.0.1:8000 > /tmp/php-server.log 2>&1 &
SERVER_PID=$!
sleep 2
STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8000/index.php)
check "$STATUS" "200" "homepage loads"

BASE="http://127.0.0.1:8000"

echo "=== 3. Register an affiliate ==="
GET_RESP=$(curl -s -c /tmp/cj_aff.txt "$BASE/register.php")
CSRF1=$(echo "$GET_RESP" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
echo "csrf1: $CSRF1"

POST_RESP=$(curl -s -i -b /tmp/cj_aff.txt -c /tmp/cj_aff.txt \
  --data-urlencode "csrf_token=$CSRF1" \
  --data-urlencode "role=affiliate" \
  --data-urlencode "full_name=Kojo Planner" \
  --data-urlencode "email=kojo@example.com" \
  --data-urlencode "phone=0551234567" \
  --data-urlencode "password=password123" \
  --data-urlencode "ref=" \
  "$BASE/register.php")
LOCATION=$(echo "$POST_RESP" | grep -i "^location:" | tr -d '\r')
contains "$LOCATION" "affiliate/dashboard.php" "affiliate registration redirects to affiliate dashboard"

AFF_REF_CODE=$(mysql -u root fete -N -e "SELECT referral_code FROM users WHERE email='kojo@example.com';")
echo "Affiliate referral code: $AFF_REF_CODE"
[ -n "$AFF_REF_CODE" ] && PASS=$((PASS+1)) && echo "PASS: affiliate got a referral code" || { FAIL=$((FAIL+1)); echo "FAIL: no referral code generated"; }

echo "=== 4. Register a host WITH the affiliate's referral code ==="
GET_RESP2=$(curl -s -c /tmp/cj_host.txt "$BASE/register.php?ref=$AFF_REF_CODE")
contains "$GET_RESP2" "$AFF_REF_CODE" "referral code shown back on registration form"
CSRF2=$(echo "$GET_RESP2" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')

POST_RESP2=$(curl -s -i -b /tmp/cj_host.txt -c /tmp/cj_host.txt \
  --data-urlencode "csrf_token=$CSRF2" \
  --data-urlencode "role=host" \
  --data-urlencode "full_name=Ama Host" \
  --data-urlencode "email=ama@example.com" \
  --data-urlencode "phone=0559876543" \
  --data-urlencode "password=password123" \
  --data-urlencode "ref=$AFF_REF_CODE" \
  "$BASE/register.php")
LOCATION2=$(echo "$POST_RESP2" | grep -i "^location:" | tr -d '\r')
contains "$LOCATION2" "host/dashboard.php" "host registration redirects to host dashboard"

HOST_REFERRED_BY=$(mysql -u root fete -N -e "SELECT referred_by_affiliate_id FROM users WHERE email='ama@example.com';")
AFF_ID=$(mysql -u root fete -N -e "SELECT id FROM users WHERE email='kojo@example.com';")
check "$HOST_REFERRED_BY" "$AFF_ID" "host correctly attributed to referring affiliate"

echo "=== 5. Duplicate email should fail ==="
GET_RESP3=$(curl -s -c /tmp/cj_dup.txt "$BASE/register.php")
CSRF3=$(echo "$GET_RESP3" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
POST_RESP3=$(curl -s -b /tmp/cj_dup.txt \
  --data-urlencode "csrf_token=$CSRF3" \
  --data-urlencode "role=host" \
  --data-urlencode "full_name=Fake Ama" \
  --data-urlencode "email=ama@example.com" \
  --data-urlencode "password=password123" \
  --data-urlencode "ref=" \
  "$BASE/register.php")
contains "$POST_RESP3" "already registered" "duplicate email correctly rejected"

echo "=== 6. CSRF protection ==="
POST_BAD_CSRF=$(curl -s -o /dev/null -w "%{http_code}" \
  --data-urlencode "csrf_token=wrong-token" \
  --data-urlencode "role=host" \
  --data-urlencode "full_name=X" \
  --data-urlencode "email=new@example.com" \
  --data-urlencode "password=password123" \
  "$BASE/register.php")
check "$POST_BAD_CSRF" "400" "bad CSRF token rejected with 400"

echo "=== 7. Unauthenticated access redirects to login ==="
NOAUTH_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/host/dashboard.php")
check "$NOAUTH_STATUS" "302" "host dashboard without login redirects (302)"

echo "=== 8. Host dashboard shows empty state ==="
DASH_RESP=$(curl -s -b /tmp/cj_host.txt "$BASE/host/dashboard.php")
contains "$DASH_RESP" "haven.t created an event" "empty dashboard state shown"

echo "=== 9. Create an event ==="
FORM_RESP=$(curl -s -b /tmp/cj_host.txt "$BASE/host/event-form.php")
CSRF4=$(echo "$FORM_RESP" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')

CREATE_RESP=$(curl -s -i -b /tmp/cj_host.txt \
  -F "csrf_token=$CSRF4" \
  -F "name=Ama & Kwame Wedding" \
  -F "event_type=wedding" \
  -F "event_date=2026-12-12" \
  "$BASE/host/event-form.php")
LOCATION3=$(echo "$CREATE_RESP" | grep -i "^location:" | tr -d '\r')
contains "$LOCATION3" "event-view.php" "event creation redirects to event-view"

EVENT_ID=$(mysql -u root fete -N -e "SELECT id FROM events WHERE name='Ama & Kwame Wedding';")
EVENT_SLUG=$(mysql -u root fete -N -e "SELECT slug FROM events WHERE id=$EVENT_ID;")
EVENT_QR=$(mysql -u root fete -N -e "SELECT qr_code_path FROM events WHERE id=$EVENT_ID;")
EVENT_REF_AFF=$(mysql -u root fete -N -e "SELECT referring_affiliate_id FROM events WHERE id=$EVENT_ID;")
echo "event id=$EVENT_ID slug=$EVENT_SLUG qr=$EVENT_QR ref_aff=$EVENT_REF_AFF"

[ -n "$EVENT_ID" ] && PASS=$((PASS+1)) && echo "PASS: event row created" || { FAIL=$((FAIL+1)); echo "FAIL: no event row"; }
check "$EVENT_SLUG" "ama-kwame-wedding" "slug generated correctly"
check "$EVENT_REF_AFF" "$AFF_ID" "event inherited host's referring affiliate"

echo "=== 10. QR code file actually exists and decodes to the right URL ==="
QR_ABS_PATH="/home/claude/fete/public${EVENT_QR}"
if [ -f "$QR_ABS_PATH" ]; then
  PASS=$((PASS+1)); echo "PASS: QR PNG file exists on disk at $QR_ABS_PATH"
else
  FAIL=$((FAIL+1)); echo "FAIL: QR PNG file missing at $QR_ABS_PATH"
fi
DECODED=$(zbarimg --quiet "$QR_ABS_PATH" 2>/dev/null)
contains "$DECODED" "http://localhost:8000/e/$EVENT_SLUG" "QR code decodes to correct event URL"

echo "=== 11. Event view page shows QR + share link ==="
VIEW_RESP=$(curl -s -b /tmp/cj_host.txt "$BASE/host/event-view.php?id=$EVENT_ID")
contains "$VIEW_RESP" "$EVENT_QR" "event-view page embeds QR image"
contains "$VIEW_RESP" "/e/$EVENT_SLUG" "event-view page shows public share link"

echo "=== 12. Public event page loads (via direct script, .htaccess rewrite not active on dev server) ==="
PUBLIC_RESP=$(curl -s "$BASE/e.php?slug=$EVENT_SLUG")
contains "$PUBLIC_RESP" "Ama &amp; Kwame Wedding" "public event page shows event name"
contains "$PUBLIC_RESP" "Leave a wish" "public event page shows wish/photo actions now that Phase 4 is built (was a placeholder before)"

echo "=== 13. Cross-user access denied (host B cannot see host A's event) ==="
GET_RESP_B=$(curl -s -c /tmp/cj_hostb.txt "$BASE/register.php")
CSRF_B=$(echo "$GET_RESP_B" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
curl -s -b /tmp/cj_hostb.txt -c /tmp/cj_hostb.txt \
  --data-urlencode "csrf_token=$CSRF_B" \
  --data-urlencode "role=host" \
  --data-urlencode "full_name=Efua Other" \
  --data-urlencode "email=efua@example.com" \
  --data-urlencode "password=password123" \
  --data-urlencode "ref=" \
  "$BASE/register.php" > /dev/null
CROSS_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_hostb.txt "$BASE/host/event-view.php?id=$EVENT_ID")
check "$CROSS_STATUS" "404" "host B gets 404 trying to view host A's event (query is host-scoped)"

echo "=== 14. Add and remove a sub-fund ==="
SF_RESP=$(curl -s -i -b /tmp/cj_host.txt \
  --data-urlencode "csrf_token=$CSRF4" \
  --data-urlencode "action=create" \
  --data-urlencode "event_id=$EVENT_ID" \
  --data-urlencode "name=Honeymoon Fund" \
  --data-urlencode "target_amount=5000" \
  "$BASE/host/subfund-save.php")
LOC_SF=$(echo "$SF_RESP" | grep -i "^location:" | tr -d '\r')
contains "$LOC_SF" "event-view.php?id=$EVENT_ID" "sub-fund creation redirects back to event view"

SF_ID=$(mysql -u root fete -N -e "SELECT id FROM sub_funds WHERE event_id=$EVENT_ID AND name='Honeymoon Fund';")
[ -n "$SF_ID" ] && PASS=$((PASS+1)) && echo "PASS: sub-fund row created" || { FAIL=$((FAIL+1)); echo "FAIL: sub-fund not created"; }

VIEW_RESP2=$(curl -s -b /tmp/cj_host.txt "$BASE/host/event-view.php?id=$EVENT_ID")
contains "$VIEW_RESP2" "Honeymoon Fund" "sub-fund appears on event-view page"
contains "$VIEW_RESP2" "GHS 5,000.00" "sub-fund target amount formatted correctly"

curl -s -b /tmp/cj_host.txt \
  --data-urlencode "csrf_token=$CSRF4" \
  --data-urlencode "action=delete" \
  --data-urlencode "event_id=$EVENT_ID" \
  --data-urlencode "sub_fund_id=$SF_ID" \
  "$BASE/host/subfund-save.php" > /dev/null
SF_GONE=$(mysql -u root fete -N -e "SELECT COUNT(*) FROM sub_funds WHERE id=$SF_ID;")
check "$SF_GONE" "0" "sub-fund deleted correctly"

echo "=== 15. Affiliate dashboard shows the referred event ==="
AFF_DASH=$(curl -s -b /tmp/cj_aff.txt "$BASE/affiliate/dashboard.php")
contains "$AFF_DASH" "Ama &amp; Kwame Wedding" "affiliate dashboard lists the referred event"
contains "$AFF_DASH" "register.php?ref=$AFF_REF_CODE" "affiliate dashboard shows correct referral link"

echo "=== 16. Login flow (logout then log back in) ==="
curl -s -b /tmp/cj_host.txt -c /tmp/cj_host.txt "$BASE/logout.php" > /dev/null
POST_LOGIN_CHECK=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_host.txt "$BASE/host/dashboard.php")
check "$POST_LOGIN_CHECK" "302" "after logout, dashboard redirects again"

LOGIN_GET=$(curl -s -c /tmp/cj_host2.txt "$BASE/login.php")
CSRF_LOGIN=$(echo "$LOGIN_GET" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
LOGIN_POST=$(curl -s -i -b /tmp/cj_host2.txt -c /tmp/cj_host2.txt \
  --data-urlencode "csrf_token=$CSRF_LOGIN" \
  --data-urlencode "email=ama@example.com" \
  --data-urlencode "password=password123" \
  "$BASE/login.php")
LOC_LOGIN=$(echo "$LOGIN_POST" | grep -i "^location:" | tr -d '\r')
contains "$LOC_LOGIN" "host/dashboard.php" "re-login redirects to host dashboard"

WRONG_PW=$(curl -s -c /tmp/cj_wrong.txt "$BASE/login.php")
CSRF_WRONG=$(echo "$WRONG_PW" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
WRONG_RESP=$(curl -s -b /tmp/cj_wrong.txt \
  --data-urlencode "csrf_token=$CSRF_WRONG" \
  --data-urlencode "email=ama@example.com" \
  --data-urlencode "password=wrongpassword" \
  "$BASE/login.php")
contains "$WRONG_RESP" "Incorrect email or password" "wrong password shows error"

echo "=== 17. Seed and test admin account ==="
cd /home/claude/fete
printf "Admin User\nadmin@example.com\nAdminPass123\n" | php database/seed_admin.php
ADMIN_EXISTS=$(mysql -u root fete -N -e "SELECT COUNT(*) FROM users WHERE email='admin@example.com' AND role='admin';")
check "$ADMIN_EXISTS" "1" "admin account created via CLI script"

ADMIN_LOGIN_GET=$(curl -s -c /tmp/cj_admin.txt "$BASE/login.php")
CSRF_ADMIN=$(echo "$ADMIN_LOGIN_GET" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
ADMIN_LOGIN_POST=$(curl -s -i -b /tmp/cj_admin.txt -c /tmp/cj_admin.txt \
  --data-urlencode "csrf_token=$CSRF_ADMIN" \
  --data-urlencode "email=admin@example.com" \
  --data-urlencode "password=AdminPass123" \
  "$BASE/login.php")
LOC_ADMIN=$(echo "$ADMIN_LOGIN_POST" | grep -i "^location:" | tr -d '\r')
contains "$LOC_ADMIN" "admin/dashboard.php" "admin login redirects to admin dashboard"

ADMIN_DASH=$(curl -s -b /tmp/cj_admin.txt "$BASE/admin/dashboard.php")
contains "$ADMIN_DASH" "2 hosts" "admin dashboard shows correct host count"
contains "$ADMIN_DASH" "1 affiliates" "admin dashboard shows correct affiliate count"

echo "=== 18. Suspended account is locked out immediately ==="
mysql -u root fete -e "UPDATE users SET status='suspended' WHERE email='ama@example.com';"
SUSPENDED_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_host2.txt "$BASE/host/dashboard.php")
check "$SUSPENDED_STATUS" "302" "suspended host is kicked out on next request despite valid session"

echo ""
echo "=================================="
echo "RESULTS: $PASS passed, $FAIL failed"
echo "=================================="

kill $SERVER_PID 2>/dev/null