#!/bin/sh

# Read-only post-update smoke test for NCV DCIMS production gateway.

set -eu

BASE_URL=${1:-}
EXPECTED_VERSION=${2:-0.2.30}

case "$BASE_URL" in
  https://*) ;;
  *) printf '%s\n' 'Usage: ncv-dcims-post-update-smoke-test.sh https://host[:port] [expected-version]' >&2; exit 64 ;;
esac

BASE_URL=${BASE_URL%/}
TMP_ROOT=$(mktemp -d "${TMPDIR:-/tmp}/ncv-dcims-smoke.XXXXXX")
trap 'rm -rf "$TMP_ROOT"' EXIT HUP INT TERM

request_body() {
  target=$1
  output=$2
  curl --fail --silent --show-error --location --max-time 15 --proto '=https' --tlsv1.2 "$target" --output "$output"
}

request_body "$BASE_URL/gateway-health" "$TMP_ROOT/gateway.json"
grep -Fq '"status":"ok"' "$TMP_ROOT/gateway.json"
! grep -Eq '"(service|version)"' "$TMP_ROOT/gateway.json"

curl --fail --silent --show-error --max-time 15 --proto '=https' --tlsv1.2 --dump-header "$TMP_ROOT/api-health.headers" "$BASE_URL/api/v1/health" --output "$TMP_ROOT/api-health.json"
grep -Fq '"status":"ok"' "$TMP_ROOT/api-health.json"
! grep -Eq '"(service|version)"' "$TMP_ROOT/api-health.json"
! grep -Eqi '^x-powered-by:' "$TMP_ROOT/api-health.headers"

version_status=$(curl --silent --show-error --max-time 15 --proto '=https' --tlsv1.2 --output "$TMP_ROOT/api-version.body" --write-out '%{http_code}' "$BASE_URL/api/v1/version")
[ "$version_status" = "404" ] || { printf '%s\n' "NCV_DCIMS_SMOKE_FAILED: public version route must return 404, received $version_status" >&2; exit 20; }

treatment_route_status=$(curl --silent --show-error --max-time 15 --proto '=https' --tlsv1.2 --request POST --header "origin: $BASE_URL" --header 'content-type: application/json' --data '{}' --output "$TMP_ROOT/treatment-route.body" --write-out '%{http_code}' "$BASE_URL/api/v1/patients/00000000-0000-4000-8000-000000000000/treatments")
[ "$treatment_route_status" = "401" ] || { printf '%s\n' "NCV_DCIMS_SMOKE_FAILED: Treatment POST route expected 401 without session, received $treatment_route_status" >&2; exit 21; }
docs_status=$(curl --silent --show-error --max-time 15 --proto '=https' --tlsv1.2 --output "$TMP_ROOT/docs.body" --write-out '%{http_code}' "$BASE_URL/api/docs")
[ "$docs_status" = "404" ] || { printf '%s\n' 'NCV_DCIMS_SMOKE_FAILED: production API docs must return 404' >&2; exit 20; }

curl --fail --silent --show-error --max-time 15 --proto '=https' --tlsv1.2 --dump-header "$TMP_ROOT/root.headers" "$BASE_URL/" --output "$TMP_ROOT/root.html"
grep -Fqi '<title>DCIMS - Nụ Cười Việt</title>' "$TMP_ROOT/root.html"
grep -Eqi '^strict-transport-security:' "$TMP_ROOT/root.headers"
grep -Eqi '^content-security-policy:' "$TMP_ROOT/root.headers"
grep -Eqi "^content-security-policy:.*script-src[^;]*'nonce-[A-Za-z0-9]+'" "$TMP_ROOT/root.headers"
! grep -Eqi "^content-security-policy:.*script-src[^;]*'unsafe-inline'" "$TMP_ROOT/root.headers"
grep -Eqi '^x-content-type-options:[[:space:]]*nosniff' "$TMP_ROOT/root.headers"
grep -Eqi '^x-frame-options:[[:space:]]*DENY' "$TMP_ROOT/root.headers"
grep -Eqi '^x-robots-tag:[[:space:]]*noindex' "$TMP_ROOT/root.headers"
request_body "$BASE_URL/robots.txt" "$TMP_ROOT/robots.txt"
grep -Eqi '^Disallow:[[:space:]]*/' "$TMP_ROOT/robots.txt"

printf '%s\n' 'NCV_DCIMS_POST_UPDATE_SMOKE_OK'