#!/bin/bash
set -uo pipefail
PASS=0
FAIL=0

check() {
  if [ "$1" = "$2" ]; then PASS=$((PASS+1)); echo "PASS: $3 (got: $1)";
  else FAIL=$((FAIL+1)); echo "FAIL: $3 -- expected [$2] got [$1]"; fi
}
contains() {
  if echo "$1" | grep -q "$2"; then PASS=$((PASS+1)); echo "PASS: $3";
  else FAIL=$((FAIL+1)); echo "FAIL: $3 -- did not find '$2'"; fi
}
not_contains() {
  if echo "$1" | grep -q "$2"; then FAIL=$((FAIL+1)); echo "FAIL: $3 -- unexpectedly found '$2'";
  else PASS=$((PASS+1)); echo "PASS: $3"; fi
}

echo "=== Setup: fresh schema + seed host A, host B, one event each ==="
service mariadb start 2>&1 | tail -1
sleep 2
mysql -u root -e "DROP DATABASE IF EXISTS fete; CREATE DATABASE fete;"
mysql -u root fete < /home/claude/fete/database/schema.sql
mysql -u root -e "CREATE USER IF NOT EXISTS 'fete_user'@'127.0.0.1' IDENTIFIED BY 'testpass123'; GRANT ALL PRIVILEGES ON fete.* TO 'fete_user'@'127.0.0.1'; FLUSH PRIVILEGES;"
mysql -u root fete -e "INSERT INTO users (id, role, full_name, email, password_hash) VALUES (1, 'host', 'Host A', 'hosta@example.com', '$(php -r "echo password_hash('password123', PASSWORD_DEFAULT);")');"
mysql -u root fete -e "INSERT INTO users (id, role, full_name, email, password_hash) VALUES (2, 'host', 'Host B', 'hostb@example.com', '$(php -r "echo password_hash('password123', PASSWORD_DEFAULT);")');"
mysql -u root fete -e "INSERT INTO events (id, host_id, name, event_type, event_date, slug, status) VALUES (1, 1, 'Test Wedding', 'wedding', '2026-12-01', 'test-wedding', 'live');"
mysql -u root fete -e "INSERT INTO donations (event_id, donor_name, amount, currency, amount_in_base, flutterwave_tx_ref, status) VALUES (1, 'Efua', 500.00, 'GHS', 500.00, 'FETE-SEED-1', 'successful');"

cd /home/claude/fete/public
php -S 127.0.0.1:8000 > /tmp/php-server-p4.log 2>&1 &
SERVER_PID=$!
sleep 2
BASE="http://127.0.0.1:8000"

login() {
  local email=$1 jar=$2
  local GET_RESP=$(curl -s -c "$jar" "$BASE/login.php")
  local CSRF=$(echo "$GET_RESP" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
  curl -s -b "$jar" -c "$jar" --data-urlencode "csrf_token=$CSRF" --data-urlencode "email=$email" --data-urlencode "password=password123" "$BASE/login.php" > /dev/null
}

echo "=== 1. Wish submission ==="
WISH_FORM=$(curl -s -c /tmp/cj_guest.txt "$BASE/wish.php?slug=test-wedding")
CSRF_WISH=$(echo "$WISH_FORM" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
WISH_POST=$(curl -s -b /tmp/cj_guest.txt \
  --data-urlencode "csrf_token=$CSRF_WISH" --data-urlencode "slug=test-wedding" \
  --data-urlencode "donor_name=Kojo" --data-urlencode "message=Congratulations to the happy couple!" \
  "$BASE/wish.php")
contains "$WISH_POST" "up on the wall" "wish submission confirms success"

WISH_COUNT=$(mysql -u root fete -N -e "SELECT COUNT(*) FROM wishes WHERE event_id=1 AND donor_name='Kojo';")
check "$WISH_COUNT" "1" "wish row created in DB"

echo "=== 2. Validation: empty message rejected ==="
EMPTY_WISH=$(curl -s -b /tmp/cj_guest.txt \
  --data-urlencode "csrf_token=$CSRF_WISH" --data-urlencode "slug=test-wedding" \
  --data-urlencode "donor_name=X" --data-urlencode "message=" \
  "$BASE/wish.php")
contains "$EMPTY_WISH" "write a wish" "empty wish message rejected"

echo "=== 3. Validation: over-length message rejected ==="
LONG_MSG=$(python3 -c "print('a'*501)")
LONG_WISH=$(curl -s -b /tmp/cj_guest.txt \
  --data-urlencode "csrf_token=$CSRF_WISH" --data-urlencode "slug=test-wedding" \
  --data-urlencode "message=$LONG_MSG" \
  "$BASE/wish.php")
contains "$LONG_WISH" "500 characters" "over-length wish rejected"

echo "=== 4. Wish appears on public event page and wall ==="
PUBLIC_PAGE=$(curl -s "$BASE/e.php?slug=test-wedding")
contains "$PUBLIC_PAGE" "Congratulations to the happy couple" "wish appears on public event page"

WALL=$(curl -s "$BASE/wall.php?slug=test-wedding")
contains "$WALL" "Congratulations to the happy couple" "wish appears on the live wall"
contains "$WALL" "GHS 500.00" "seeded donation appears on the live wall"
contains "$WALL" 'http-equiv="refresh"' "live wall has auto-refresh meta tag"

echo "=== 5. CSRF protection on wish submission ==="
CSRF_FAIL=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_guest.txt \
  --data-urlencode "csrf_token=wrong" --data-urlencode "slug=test-wedding" --data-urlencode "message=hacked" \
  "$BASE/wish.php")
check "$CSRF_FAIL" "400" "wish submission with bad CSRF token rejected"

echo "=== 6. Host A can hide their event's wish; it disappears from public views ==="
login "hosta@example.com" /tmp/cj_hosta.txt
WISH_ID=$(mysql -u root fete -N -e "SELECT id FROM wishes WHERE donor_name='Kojo';")
WISHES_PAGE=$(curl -s -b /tmp/cj_hosta.txt "$BASE/host/wishes.php?id=1")
CSRF_HIDE=$(echo "$WISHES_PAGE" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
curl -s -b /tmp/cj_hosta.txt \
  --data-urlencode "csrf_token=$CSRF_HIDE" --data-urlencode "wish_id=$WISH_ID" --data-urlencode "action=hide" \
  "$BASE/host/wishes.php?id=1" > /dev/null

PUBLIC_AFTER_HIDE=$(curl -s "$BASE/e.php?slug=test-wedding")
not_contains "$PUBLIC_AFTER_HIDE" "Congratulations to the happy couple" "hidden wish no longer shows on public event page"
WALL_AFTER_HIDE=$(curl -s "$BASE/wall.php?slug=test-wedding")
not_contains "$WALL_AFTER_HIDE" "Congratulations to the happy couple" "hidden wish no longer shows on live wall"

echo "=== 7. Host B cannot hide Host A's event's wishes (cross-user protection) ==="
login "hostb@example.com" /tmp/cj_hostb.txt
CROSS_WISH_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_hostb.txt "$BASE/host/wishes.php?id=1")
check "$CROSS_WISH_STATUS" "404" "host B gets 404 viewing host A's wishes page"

echo "=== 8. Wish export produces a correctly formatted text file ==="
mysql -u root fete -e "INSERT INTO wishes (event_id, donor_name, message) VALUES (1, 'Ama', 'Wishing you a lifetime of happiness');"
EXPORT=$(curl -s -b /tmp/cj_hosta.txt "$BASE/host/wishes.php?id=1" > /dev/null; curl -s -i -b /tmp/cj_hosta.txt "$BASE/host/wishes-export.php?id=1")
contains "$EXPORT" "Content-Disposition: attachment" "export sends as a downloadable attachment"
contains "$EXPORT" "Wishes for Test Wedding" "export file has correct header"
contains "$EXPORT" "Wishing you a lifetime of happiness" "export contains the visible wish"
not_contains "$EXPORT" "Congratulations to the happy couple" "export correctly excludes the hidden wish"

echo "=== 9. Photo upload ==="
python3 -c "from PIL import Image; Image.new('RGB',(80,80),(90,140,90)).save('/tmp/phase4-photo.jpg')" 2>/tmp/pil_err.txt
UPLOAD_FORM=$(curl -s -b /tmp/cj_guest.txt "$BASE/upload.php?slug=test-wedding")
CSRF_UP=$(echo "$UPLOAD_FORM" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
UPLOAD_RESP=$(curl -s -b /tmp/cj_guest.txt \
  -F "csrf_token=$CSRF_UP" -F "slug=test-wedding" -F "photo=@/tmp/phase4-photo.jpg;type=image/jpeg" \
  "$BASE/upload.php")
contains "$UPLOAD_RESP" "appear once the host approves" "photo upload confirms pending approval"

PHOTO_ID=$(mysql -u root fete -N -e "SELECT id FROM photos WHERE event_id=1 ORDER BY id DESC LIMIT 1;")
PHOTO_STATUS=$(mysql -u root fete -N -e "SELECT status FROM photos WHERE id=$PHOTO_ID;")
check "$PHOTO_STATUS" "pending" "uploaded photo starts pending"
PHOTO_PATH=$(mysql -u root fete -N -e "SELECT file_path FROM photos WHERE id=$PHOTO_ID;")
if [ -f "/home/claude/fete/public$PHOTO_PATH" ]; then PASS=$((PASS+1)); echo "PASS: uploaded photo file exists on disk"; else FAIL=$((FAIL+1)); echo "FAIL: uploaded photo file missing"; fi

echo "=== 10. Validation: wrong file type rejected ==="
echo "not an image" > /tmp/fake.txt
BAD_TYPE=$(curl -s -b /tmp/cj_guest.txt \
  -F "csrf_token=$CSRF_UP" -F "slug=test-wedding" -F "photo=@/tmp/fake.txt;type=text/plain" \
  "$BASE/upload.php")
contains "$BAD_TYPE" "JPG, PNG, or WEBP" "non-image upload rejected"

echo "=== 11. Validation: no file selected rejected ==="
NO_FILE=$(curl -s -b /tmp/cj_guest.txt -F "csrf_token=$CSRF_UP" -F "slug=test-wedding" "$BASE/upload.php")
contains "$NO_FILE" "choose a photo" "missing file rejected"

echo "=== 12. Host A approves the pending photo; it appears publicly ==="
PHOTOS_PAGE=$(curl -s -b /tmp/cj_hosta.txt "$BASE/host/photos.php?id=1")
contains "$PHOTOS_PAGE" "Waiting for approval (1)" "host photos page shows 1 pending"
CSRF_MOD=$(echo "$PHOTOS_PAGE" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
curl -s -b /tmp/cj_hosta.txt \
  --data-urlencode "csrf_token=$CSRF_MOD" --data-urlencode "event_id=1" --data-urlencode "photo_id=$PHOTO_ID" --data-urlencode "action=approve" \
  "$BASE/host/photo-moderate.php" > /dev/null

APPROVED_STATUS=$(mysql -u root fete -N -e "SELECT status FROM photos WHERE id=$PHOTO_ID;")
check "$APPROVED_STATUS" "approved" "photo status updated to approved"
PUBLIC_WITH_PHOTO=$(curl -s "$BASE/e.php?slug=test-wedding")
contains "$PUBLIC_WITH_PHOTO" "$PHOTO_PATH" "approved photo now shows on public event page"

echo "=== 13. Host B cannot moderate Host A's photos (cross-user protection) ==="
HOSTB_PHOTOS_PAGE=$(curl -s -b /tmp/cj_hostb.txt "$BASE/host/photos.php?id=1")
CROSS_PHOTOS_VIEW=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_hostb.txt "$BASE/host/photos.php?id=1")
check "$CROSS_PHOTOS_VIEW" "404" "host B gets 404 viewing host A's photos page"

# Get a VALID csrf token from host B's own session via a page they can
# access with no events of their own (event-form.php's create mode), so
# this actually tests the ownership check rather than just re-testing CSRF.
HOSTB_FORM=$(curl -s -b /tmp/cj_hostb.txt "$BASE/host/event-form.php")
CSRF_HOSTB=$(echo "$HOSTB_FORM" | grep -o 'name="csrf_token" value="[^"]*"' | head -1 | sed 's/.*value="//;s/"//')
CROSS_MOD_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -b /tmp/cj_hostb.txt \
  --data-urlencode "csrf_token=$CSRF_HOSTB" --data-urlencode "event_id=1" --data-urlencode "photo_id=$PHOTO_ID" --data-urlencode "action=reject" \
  "$BASE/host/photo-moderate.php")
check "$CROSS_MOD_STATUS" "403" "host B's cross-user photo moderation attempt rejected by ownership check (valid CSRF, still blocked)"

STILL_APPROVED=$(mysql -u root fete -N -e "SELECT status FROM photos WHERE id=$PHOTO_ID;")
check "$STILL_APPROVED" "approved" "photo status unchanged after host B's blocked attempt"

echo ""
echo "=================================="
echo "RESULTS: $PASS passed, $FAIL failed"
echo "=================================="
kill $SERVER_PID 2>/dev/null