#!/bin/sh
API="http://127.0.0.1:28081"
AUTH="-u admin:ikuai8.com"
PASS=0; FAIL=0

check() {
  local name="$1" got="$2" want="$3"
  if echo "$got" | grep -q "$want"; then
    echo "[PASS] $name"; PASS=$((PASS+1))
  else
    echo "[FAIL] $name"
    echo "       want: $want"
    echo "       got:  $(echo "$got" | head -1 | cut -c1-120)"
    FAIL=$((FAIL+1))
  fi
}

echo "==============================="
echo " ProxyFlow 3.2.3 真机验证 v2"
echo "==============================="

# 读 controller 端口
CTRL_PORT=$(curl -s $AUTH "$API/api/v1/system/status" 2>/dev/null | grep -o '"controller_port":[0-9]*' | grep -o '[0-9]*$')
[ -z "$CTRL_PORT" ] && CTRL_PORT=29091
echo "[INFO] mihomo controller: 127.0.0.1:$CTRL_PORT"

# 1. 版本 (manifest)
VER=$(cat /etc/log/apps/proxyflow-amd64/.pkg/manifest.json 2>/dev/null | grep -o '"version":"[^"]*"' | head -1)
check "版本是3.2.3(manifest)" "$VER" "3.2.3"

# 2. /auth/session 拒绝 Basic Auth
SC=$(curl -s -o /dev/null -w "%{http_code}" -u admin:ikuai8.com "$API/api/v1/auth/session")
check "/auth/session 拒绝Basic Auth(401)" "$SC" "401"

# 3. /auth/session 无凭据也 401
SC2=$(curl -s -o /dev/null -w "%{http_code}" "$API/api/v1/auth/session")
check "/auth/session 无凭据返回401" "$SC2" "401"

# 4. 命名空间唯一性
echo "--- 清理测试数据 ---"
curl -s $AUTH -X DELETE "$API/api/v1/groups?name=pf-ns-grp" >/dev/null 2>&1
curl -s $AUTH -X DELETE "$API/api/v1/groups?name=pf-grp-test" >/dev/null 2>&1
# 清理旧测试订阅
for sid in $(curl -s $AUTH "$API/api/v1/subscriptions" 2>/dev/null | grep -o '"id":[0-9]*' | grep -o '[0-9]*'); do
  resp=$(curl -s $AUTH "$API/api/v1/subscriptions" 2>/dev/null)
  echo "$resp" | grep -q "pf-ns-verify\|pf-grp-test" && \
    curl -s $AUTH -X DELETE "$API/api/v1/subscriptions?id=$sid&delete_nodes=1" >/dev/null 2>&1
done

echo "--- 4a. 创建订阅 pf-ns-verify(group=pf-ns-grp) ---"
SUB_RESP=$(curl -s $AUTH -X POST "$API/api/v1/subscriptions" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-ns-verify","url":"http://127.0.0.1:1/fake","group_name":"pf-ns-grp"}')
SUB_ID=$(echo "$SUB_RESP" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
echo "    订阅ID=$SUB_ID"

SC3=$(curl -s -o /dev/null -w "%{http_code}" $AUTH -X POST "$API/api/v1/groups" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-ns-grp","remark":"should fail"}')
check "4a. 分组名=订阅group_name被拒(400)" "$SC3" "400"

SC4=$(curl -s -o /dev/null -w "%{http_code}" $AUTH -X POST "$API/api/v1/subscriptions" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-ns-verify","url":"http://127.0.0.1:1/fake2"}')
check "4b. 同名订阅二次创建被拒(400)" "$SC4" "400"

curl -s $AUTH -X POST "$API/api/v1/groups" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-grp-test","remark":"manual"}' >/dev/null 2>&1
SC5=$(curl -s -o /dev/null -w "%{http_code}" $AUTH -X POST "$API/api/v1/subscriptions" \
  -H "Content-Type: application/json" \
  -d '{"name":"pf-grp-test","url":"http://127.0.0.1:1/fake3"}')
check "4c. 订阅名=手动分组名被拒(400)" "$SC5" "400"

[ -n "$SUB_ID" ] && curl -s $AUTH -X DELETE "$API/api/v1/subscriptions?id=$SUB_ID&delete_nodes=1" >/dev/null 2>&1
curl -s $AUTH -X DELETE "$API/api/v1/groups?name=pf-grp-test" >/dev/null 2>&1

# 5. 真测速
echo "--- 真测速 ---"
NR=$(curl -s $AUTH -X POST "$API/api/v1/nodes" \
  -H "Content-Type: application/json" \
  -d '{"name":"fake-socks-19999","protocol":"socks5","server":"127.0.0.1","port":19999,"enabled":true}')
NID=$(echo "$NR" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
if [ -n "$NID" ]; then
  sleep 1
  DR=$(curl -s $AUTH "$API/api/v1/nodes/delay?id=$NID" 2>/dev/null)
  echo "    测速: $(echo "$DR" | cut -c1-120)"
  if echo "$DR" | grep -qE '"delay":-1|"error":.|SOCKS5'; then
    check "5. 真测速:不可用端口返回失败(delay=-1/error)" "OK" "OK"
  else
    check "5. 真测速:不可用端口返回失败" "$DR" '"delay":-1'
  fi
  curl -s $AUTH -X DELETE "$API/api/v1/nodes?ids=$NID" >/dev/null 2>&1
fi

# 6. 分组联动 — 通过 mihomo controller 验证 proxy-groups
echo "--- 分组联动 (via mihomo controller :$CTRL_PORT) ---"
N1=$(curl -s $AUTH -X POST "$API/api/v1/nodes" \
  -H "Content-Type: application/json" \
  -d '{"name":"hk-v2-01","protocol":"socks5","server":"1.2.3.4","port":1080,"group":"hk-verify","enabled":true}' \
  2>/dev/null | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
N2=$(curl -s $AUTH -X POST "$API/api/v1/nodes" \
  -H "Content-Type: application/json" \
  -d '{"name":"tw-v2-01","protocol":"socks5","server":"5.6.7.8","port":1080,"group":"tw-verify","enabled":true}' \
  2>/dev/null | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
echo "    节点 hk=$N1 tw=$N2"
sleep 3

PROXIES=$(curl -s "http://127.0.0.1:$CTRL_PORT/proxies" 2>/dev/null)
if echo "$PROXIES" | grep -q "hk-verify"; then
  check "6a. mihomo中有hk-verify独立组" "$PROXIES" "hk-verify"
  check "6b. mihomo中有tw-verify独立组" "$PROXIES" "tw-verify"
  # hk-verify 组成员只含 hk-v2-01，不含 tw-v2-01
  HK_MEMBERS=$(echo "$PROXIES" | grep -A5 '"hk-verify"' | head -10)
  if echo "$HK_MEMBERS" | grep -q "tw-v2-01"; then
    echo "[FAIL] 6c. tw节点混入hk-verify组"; FAIL=$((FAIL+1))
  else
    echo "[PASS] 6c. hk-verify组不含tw节点(分组隔离正确)"; PASS=$((PASS+1))
  fi
else
  echo "[INFO] mihomo未同步最新配置，尝试触发重载..."
  curl -s $AUTH -X POST "$API/api/v1/system/reload" >/dev/null 2>&1
  sleep 3
  PROXIES2=$(curl -s "http://127.0.0.1:$CTRL_PORT/proxies" 2>/dev/null)
  check "6a. mihomo中有hk-verify独立组(reload后)" "$PROXIES2" "hk-verify"
  check "6b. mihomo中有tw-verify独立组(reload后)" "$PROXIES2" "tw-verify"
fi

# 7. 套娃出口 listener proxy 指向节点分组
echo "--- 套娃出口 ---"
SR=$(curl -s $AUTH -X POST "$API/api/v1/proxy-services" \
  -H "Content-Type: application/json" \
  -d '{"name":"hk-relay-v2","outbound_interface":"lo","port":19081,"protocol":"mixed","exit_group":"hk-verify","enabled":true}')
SID=$(echo "$SR" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
echo "    代理服务ID=$SID"
sleep 2
LISTENERS=$(curl -s "http://127.0.0.1:$CTRL_PORT/listeners" 2>/dev/null)
echo "    listeners: $(echo "$LISTENERS" | cut -c1-200)"
if echo "$LISTENERS" | grep -qE "hk-verify"; then
  check "7. 套娃listener proxy→hk-verify分组" "$LISTENERS" "hk-verify"
else
  # mihomo listeners API可能不存在，改查proxies里的入站
  check "7. 套娃listener proxy→hk-verify分组" "$(curl -s "http://127.0.0.1:$CTRL_PORT/proxies" 2>/dev/null)" "hk-relay-v2\|hk-verify"
fi

# 清理
[ -n "$SID" ] && curl -s $AUTH -X DELETE "$API/api/v1/proxy-services?ids=$SID" >/dev/null 2>&1
[ -n "$N1" ] && curl -s $AUTH -X DELETE "$API/api/v1/nodes?ids=$N1" >/dev/null 2>&1
[ -n "$N2" ] && curl -s $AUTH -X DELETE "$API/api/v1/nodes?ids=$N2" >/dev/null 2>&1

echo ""
echo "==============================="
echo " 结果: PASS=$PASS  FAIL=$FAIL"
echo "==============================="