#!/bin/sh
API="http://127.0.0.1:28081"
AUTH="-u admin:ikuai8.com"
DB="/etc/log/apps/proxyflow-amd64/data/proxyflow.db"
PASS=0; FAIL=0

check() {
  local name="$1" got="$2" want="$3"
  if echo "$got" | grep -q "$want"; then
    echo "[PASS] $name"
    PASS=$((PASS+1))
  else
    echo "[FAIL] $name"
    echo "       want: $want"
    echo "       got:  $(echo "$got" | head -1 | cut -c1-120)"
    FAIL=$((FAIL+1))
  fi
}

echo "==============================="
echo " ProxyFlow 3.2.3 真机验证"
echo "==============================="

# 1. 版本
STATUS=$(curl -s $AUTH "$API/api/v1/system/status" 2>/dev/null)
check "版本是3.2.3" "$STATUS" "3.2.3"

# 2. /auth/session 对 Basic Auth 返回 401
SC=$(curl -s -o /dev/null -w "%{http_code}" -u admin:ikuai8.com "$API/api/v1/auth/session")
check "/auth/session 拒绝Basic Auth(401)" "$SC" "401"

# 3. /auth/session 无凭据也是 401
SC2=$(curl -s -o /dev/null -w "%{http_code}" "$API/api/v1/auth/session")
check "/auth/session 无凭据返回401" "$SC2" "401"

# 4. Bearer token 正常访问
TOK=$(sqlite3 "$DB" "SELECT value FROM system_settings WHERE key='api_token';" 2>/dev/null)
[ -z "$TOK" ] && TOK=$(sqlite3 "$DB" "SELECT value FROM advanced_settings WHERE key='api_token';" 2>/dev/null)
if [ -n "$TOK" ]; then
  SC3=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $TOK" "$API/api/v1/nodes")
  check "Bearer token 可正常访问API(200)" "$SC3" "200"
else
  echo "[SKIP] DB未能读到api_token"
fi

# ── 命名空间唯一性 ──────────────────────────────────────────
echo "--- 清理旧测试数据 ---"
for sid in $(curl -s $AUTH "$API/api/v1/subscriptions" 2>/dev/null | grep -o '"id":[0-9]*' | grep -o '[0-9]*'); do
  NAME=$(curl -s $AUTH "$API/api/v1/subscriptions" 2>/dev/null | grep -o '"name":"pf-ns[^"]*"' | head -1)
  echo "$NAME" | grep -q "pf-ns" && curl -s $AUTH -X DELETE "$API/api/v1/subscriptions?id=$sid" >/dev/null 2>&1
done
curl -s $AUTH -X DELETE "$API/api/v1/groups?name=pf-grp-test" >/dev/null 2>&1
curl -s $AUTH -X DELETE "$API/api/v1/groups?name=pf-ns-grp" >/dev/null 2>&1

echo "--- 创建测试订阅(group_name=pf-ns-grp) ---"
SUB_RESP=$(curl -s $AUTH -X POST "$API/api/v1/subscriptions" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-ns-verify","url":"http://127.0.0.1:1/fake","group_name":"pf-ns-grp"}' 2>/dev/null)
echo "订阅响应: $(echo "$SUB_RESP" | cut -c1-80)"
SUB_ID=$(echo "$SUB_RESP" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')

# 5a. 用 group_name (pf-ns-grp) 创建手动分组 → 应被拒绝(400)
GRP_RESP=$(curl -s -w "\nHTTP_%{http_code}" $AUTH -X POST "$API/api/v1/groups" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-ns-grp","remark":"should fail"}' 2>/dev/null)
GRP_CODE=$(echo "$GRP_RESP" | grep "HTTP_" | tail -1)
check "分组名=订阅group_name 被拒绝(400)" "$GRP_CODE" "HTTP_400"

# 5b. 重名订阅 → 应被拒绝(400)
SC4=$(curl -s -o /dev/null -w "%{http_code}" $AUTH -X POST "$API/api/v1/subscriptions" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-ns-verify","url":"http://127.0.0.1:1/fake2"}' 2>/dev/null)
check "同名订阅二次创建被拒绝(400)" "$SC4" "400"

# 5c. 先建手动分组再建同名订阅 → 应被拒绝(400)
curl -s $AUTH -X POST "$API/api/v1/groups" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-grp-test","remark":"manual group"}' >/dev/null 2>&1
SC5=$(curl -s -o /dev/null -w "%{http_code}" $AUTH -X POST "$API/api/v1/subscriptions" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-grp-test","url":"http://127.0.0.1:1/fake3"}' 2>/dev/null)
check "订阅名=手动分组名 被拒绝(400)" "$SC5" "400"

# 清理
[ -n "$SUB_ID" ] && curl -s $AUTH -X DELETE "$API/api/v1/subscriptions?id=$SUB_ID" >/dev/null 2>&1
curl -s $AUTH -X DELETE "$API/api/v1/groups?name=pf-grp-test" >/dev/null 2>&1

# ── 真测速：不存在的端口 ────────────────────────────────────
echo "--- 真测速验证 ---"
NODE_RESP=$(curl -s $AUTH -X POST "$API/api/v1/nodes" \
  -H "Content-Type: application/json" \
  -d '{"name":"test-fake-socks","protocol":"socks5","server":"127.0.0.1","port":19999,"enabled":true}' 2>/dev/null)
NODE_ID=$(echo "$NODE_RESP" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
if [ -n "$NODE_ID" ]; then
  sleep 1
  DELAY=$(curl -s $AUTH "$API/api/v1/nodes/delay?id=$NODE_ID" 2>/dev/null)
  echo "测速响应: $(echo "$DELAY" | cut -c1-120)"
  if echo "$DELAY" | grep -qE '"delay":-1|"error":.|"available":false'; then
    check "真测速:不可用端口→delay=-1或error" "MATCH" "MATCH"
  else
    check "真测速:不可用端口→delay=-1或error" "$DELAY" '"delay":-1'
  fi
  curl -s $AUTH -X DELETE "$API/api/v1/nodes?ids=$NODE_ID" >/dev/null 2>&1
else
  echo "[SKIP] 节点创建失败"
fi

# ── 分组联动 YAML ──────────────────────────────────────────
echo "--- 分组联动YAML验证 ---"
N1=$(curl -s $AUTH -X POST "$API/api/v1/nodes" \
  -H "Content-Type: application/json" \
  -d '{"name":"hk-test-01","protocol":"socks5","server":"1.2.3.4","port":1080,"group":"hk","enabled":true}' \
  2>/dev/null | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
N2=$(curl -s $AUTH -X POST "$API/api/v1/nodes" \
  -H "Content-Type: application/json" \
  -d '{"name":"tw-test-01","protocol":"socks5","server":"5.6.7.8","port":1080,"group":"tw","enabled":true}' \
  2>/dev/null | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
echo "节点 hk=$N1 tw=$N2"
sleep 2

# 正确路径: /api/v1/render
YAML=$(curl -s $AUTH "$API/api/v1/render" 2>/dev/null)
if echo "$YAML" | grep -q "proxies:"; then
  check "YAML含hk独立proxy-group" "$YAML" "name: hk"
  check "YAML含tw独立proxy-group" "$YAML" "name: tw"
  if echo "$YAML" | grep -qE "name: GROUP|name: URLTEST"; then
    echo "[FAIL] YAML仍含旧式GROUP/URLTEST大组"; FAIL=$((FAIL+1))
  else
    echo "[PASS] YAML不含旧式GROUP/URLTEST大组"; PASS=$((PASS+1))
  fi
  HK_BLOCK=$(echo "$YAML" | awk '/name: .hk./,/^  - name:/' | head -20)
  if echo "$HK_BLOCK" | grep -q "tw-test"; then
    echo "[FAIL] tw节点混入hk分组"; FAIL=$((FAIL+1))
  else
    echo "[PASS] hk分组不含tw节点(分组隔离正确)"; PASS=$((PASS+1))
  fi
else
  echo "[FAIL] /render 未返回YAML(got: $(echo "$YAML" | cut -c1-60))"
  FAIL=$((FAIL+1))
fi

# ── 套娃出口 ────────────────────────────────────────────────
echo "--- 套娃出口验证 ---"
SVC_RESP=$(curl -s $AUTH -X POST "$API/api/v1/proxy-services" \
  -H "Content-Type: application/json" \
  -d '{"name":"hk-relay","outbound_interface":"lo","port":19080,"protocol":"mixed","exit_group":"hk","enabled":true}' \
  2>/dev/null)
SVC_ID=$(echo "$SVC_RESP" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
echo "代理服务ID: $SVC_ID"
sleep 1
YAML2=$(curl -s $AUTH "$API/api/v1/render" 2>/dev/null)
if echo "$YAML2" | grep -q "proxies:"; then
  check "套娃出口:listener proxy指向hk分组" "$YAML2" "proxy: hk\|proxy: .hk."
fi

# 清理所有
[ -n "$SVC_ID" ] && curl -s $AUTH -X DELETE "$API/api/v1/proxy-services?ids=$SVC_ID" >/dev/null 2>&1
[ -n "$N1" ] && curl -s $AUTH -X DELETE "$API/api/v1/nodes?ids=$N1" >/dev/null 2>&1
[ -n "$N2" ] && curl -s $AUTH -X DELETE "$API/api/v1/nodes?ids=$N2" >/dev/null 2>&1

echo ""
echo "==============================="
echo " 结果: PASS=$PASS  FAIL=$FAIL"
echo "==============================="