#!/bin/bash

# parse options
USE_SIDECAR=false
RUN_DATA_INTEGRITY_ETAG_TESTS=true
for arg in "$@"; do
  case "$arg" in
    --sidecar) USE_SIDECAR=true ;;
	--skip-data-integrity-etag-tests) RUN_DATA_INTEGRITY_ETAG_TESTS=false ;;
  esac
done

# build sidecar flag for versitygw invocations
SIDECAR_FLAG=""
SIDECAR_TEST_FLAG=""
if $USE_SIDECAR; then
  rm -rf /tmp/sidecar
  mkdir /tmp/sidecar
  SIDECAR_FLAG="--sidecar /tmp/sidecar"
  SIDECAR_TEST_FLAG="--sidecar"
fi

# make temp dirs
rm -rf /tmp/gw
mkdir /tmp/gw
rm -rf /tmp/covdata
mkdir /tmp/covdata
rm -rf /tmp/https.covdata
mkdir /tmp/https.covdata
rm -rf /tmp/versioning.covdata
mkdir /tmp/versioning.covdata
rm -rf /tmp/versioning.https.covdata
mkdir /tmp/versioning.https.covdata
rm -rf /tmp/noacl.covdata
mkdir /tmp/noacl.covdata

rm -rf /tmp/versioningdir
mkdir /tmp/versioningdir

# setup tls certificate and key
ECHO "Generating TLS certificate and key in the cert.pem and key.pem files"

openssl genpkey -algorithm RSA -out key.pem -pkeyopt rsa_keygen_bits:2048
openssl req -new -x509 -key key.pem -out cert.pem -days 365 -subj "/C=US/ST=California/L=San Francisco/O=Versity/OU=Software/CN=versity.com"

ECHO "Running the sdk test over http"
# run server in background not versioning-enabled
# port: 7070(default)
GOCOVERDIR=/tmp/covdata ./versitygw -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG /tmp/gw &
GW_PID=$!

sleep 1

# check if gateway process is still running
if ! kill -0 $GW_PID; then
	echo "server no longer running"
	exit 1
fi

# run tests
# full flow tests
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7070 full-flow --parallel $SIDECAR_TEST_FLAG; then
	echo "full flow tests failed"
	kill $GW_PID
	exit 1
fi
# posix tests
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7070 posix; then
	echo "posix tests failed"
	kill $GW_PID
	exit 1
fi
# gateway iam tests
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7070 gw-iam; then
	echo "gateway iam tests failed"
	kill $GW_PID
	exit 1
fi

kill $GW_PID

ECHO "Running the sdk test over https"

# run server in background with TLS certificate
# port: 7071(default)
GOCOVERDIR=/tmp/https.covdata ./versitygw --cert "$PWD/cert.pem" --key "$PWD/key.pem" -p :7071 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG /tmp/gw &
GW_HTTPS_PID=$!

sleep 1

# check if https gateway process is still running
if ! kill -0 $GW_HTTPS_PID; then
	echo "server no longer running"
	exit 1
fi

# run tests
# full flow tests
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7071 full-flow --parallel $SIDECAR_TEST_FLAG; then
	echo "full flow tests failed"
	kill $GW_HTTPS_PID
	exit 1
fi
# posix tests
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7071 posix; then
	echo "posix tests failed"
	kill $GW_HTTPS_PID
	exit 1
fi
# gateway iam tests
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7071 gw-iam; then
	echo "gateway iam tests failed"
	kill $GW_HTTPS_PID
	exit 1
fi

kill $GW_HTTPS_PID

ECHO "Running the sdk test over http against the versioning-enabled gateway"
# run server in background versioning-enabled
# port: 7072
GOCOVERDIR=/tmp/versioning.covdata ./versitygw -p :7072 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG --versioning-dir /tmp/versioningdir /tmp/gw &
GW_VS_PID=$!

# wait a second for server to start up
sleep 1

# check if versioning-enabled gateway process is still running
if ! kill -0 $GW_VS_PID; then
	echo "versioning-enabled server no longer running"
	exit 1
fi

# run tests
# full flow tests
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7072 full-flow -vs --parallel $SIDECAR_TEST_FLAG; then
	echo "versioning-enabled full-flow tests failed"
	kill $GW_VS_PID
	exit 1
fi
# posix tests
if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7072 posix -vs; then
	echo "versiongin-enabled posix tests failed"
	kill $GW_VS_PID
	exit 1
fi

# kill off server
kill $GW_VS_PID

ECHO "Running the sdk test over https against the versioning-enabled gateway"
# run server in background versioning-enabled
# port: 7073
GOCOVERDIR=/tmp/versioning.https.covdata ./versitygw --cert "$PWD/cert.pem" --key "$PWD/key.pem" -p :7073 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG --versioning-dir /tmp/versioningdir /tmp/gw &
GW_VS_HTTPS_PID=$!

# wait a second for server to start up
sleep 1

# check if versioning-enabled gateway process is still running
if ! kill -0 $GW_VS_HTTPS_PID; then
	echo "versioning-enabled server no longer running"
	exit 1
fi

# run tests
# full flow tests
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7073 full-flow -vs --parallel $SIDECAR_TEST_FLAG; then
	echo "versioning-enabled full-flow tests failed"
	kill $GW_VS_HTTPS_PID
	exit 1
fi
# posix tests
if ! ./versitygw test --allow-insecure -a user -s pass -e https://127.0.0.1:7073 posix -vs; then
	echo "versiongin-enabled posix tests failed"
	kill $GW_VS_HTTPS_PID
	exit 1
fi

# kill off server
kill $GW_VS_HTTPS_PID

if $RUN_DATA_INTEGRITY_ETAG_TESTS; then
ECHO "Running data-integrity-etag integration tests"
# run server in background with data-integrity-etag enabled
# port: 7075
GOCOVERDIR=/tmp/covdata ./versitygw -p :7075 -a user -s pass --iam-dir /tmp/gw posix $SIDECAR_FLAG --data-integrity-etag /tmp/gw &
GW_DI_ETAG_PID=$!

# wait a second for server to start up
sleep 1

# check if data-integrity-etag gateway process is still running
if ! kill -0 $GW_DI_ETAG_PID; then
	echo "data-integrity-etag server no longer running"
	exit 1
fi

if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7075 data-integrity-etag; then
	echo "data-integrity-etag tests failed"
	kill $GW_DI_ETAG_PID
	exit 1
fi

kill $GW_DI_ETAG_PID
fi

ECHO "Running No ACL integration tests"
# run server in background versioning-enabled
# port: 7073
GOCOVERDIR=/tmp/noacl.covdata ./versitygw -p :7074 -a user -s pass -noacl --iam-dir /tmp/gw posix $SIDECAR_FLAG /tmp/gw &
GW_NO_ACL_PID=$!

# wait a second for server to start up
sleep 1

# check if noacl gateway process is still running
if ! kill -0 $GW_NO_ACL_PID; then
	echo "noacl server no longer running"
	exit 1
fi

if ! ./versitygw test --allow-insecure -a user -s pass -e http://127.0.0.1:7074 noacl; then
	echo "No ACL integration tests failed"
	kill $GW_NO_ACL_PID
	exit 1
fi

# kill off server
kill $GW_NO_ACL_PID

ECHO "Running the s3 + standalone IAM access control tests"
# This stage is the only one that runs two versitygw processes at once: a
# standalone IAM service holding every user, policy and secret, and an s3
# gateway that reaches it over mTLS for signing keys and policy decisions.
# ports: 7080 IAM control plane, 7081 IAM private endpoint, 7082 s3 gateway
rm -rf /tmp/s3iam /tmp/s3iamgw /tmp/s3iamcerts /tmp/s3iam.covdata /tmp/s3iamgw.covdata
mkdir -p /tmp/s3iam /tmp/s3iamgw /tmp/s3iam.covdata /tmp/s3iamgw.covdata

# The gateway verifies the IAM service's certificate normally, with no
# hostname override, so the server certificate needs an IP SAN matching the
# --iam-standalone-endpoint host.
./genmtlscerts.sh /tmp/s3iamcerts 127.0.0.1

GOCOVERDIR=/tmp/s3iam.covdata ./versitygw --health /healthz -p :7080 -a user -s pass iam \
	--dir /tmp/s3iam \
	--private-ports 127.0.0.1:7081 \
	--private-cert /tmp/s3iamcerts/iam-server.pem \
	--private-cert-key /tmp/s3iamcerts/iam-server.key \
	--private-client-ca /tmp/s3iamcerts/ca.pem &
IAM_PID=$!

sleep 2

if ! kill -0 $IAM_PID; then
	echo "standalone IAM service no longer running"
	exit 1
fi

GOCOVERDIR=/tmp/s3iamgw.covdata ./versitygw -p :7082 -a user -s pass \
	--iam-standalone-endpoint 127.0.0.1:7081 \
	--iam-standalone-client-cert /tmp/s3iamcerts/gw-client.pem \
	--iam-standalone-client-cert-key /tmp/s3iamcerts/gw-client.key \
	--iam-standalone-server-ca /tmp/s3iamcerts/ca.pem \
	posix $SIDECAR_FLAG /tmp/s3iamgw &
GW_S3IAM_PID=$!

sleep 2

if ! kill -0 $GW_S3IAM_PID; then
	echo "s3 gateway backed by standalone IAM no longer running"
	kill $IAM_PID
	exit 1
fi

if ! ./versitygw test -a user -s pass -e http://127.0.0.1:7082 --iam-endpoint http://127.0.0.1:7080 s3-iam; then
	echo "s3 + standalone IAM access control tests failed"
	kill $GW_S3IAM_PID
	kill $IAM_PID
	exit 1
fi

kill $GW_S3IAM_PID
kill $IAM_PID

exit 0

# -----------------------------------------------------------------------------
# Coverage Reports (Go 1.20+ Runtime Coverage)
#
# The servers above were started with GOCOVERDIR=<dir>, which causes Go to write
# raw coverage artifacts into those directories (covmeta + covcounters.* files).
# These raw files must be processed with "go tool covdata" to generate
# human-readable coverage reports.
#
# You may generate *per-environment* coverage or a *merged full-suite* report.
#
# -----------------------------------------------------------------------------
# 1) INDIVIDUAL COVERAGE REPORTS
#
# Example for a single environment (e.g. /tmp/covdata):
#
#   go tool covdata percent -i=/tmp/covdata
#   go tool covdata textfmt -i=/tmp/covdata -o /tmp/profile.txt
#   go tool cover -html=/tmp/profile.txt
#
# Repeat using:
#   /tmp/covdata
#   /tmp/https.covdata
#   /tmp/versioning.covdata
#   /tmp/versioning.https.covdata
#   /tmp/noacl.covdata
#   /tmp/s3iam.covdata      (standalone IAM service)
#   /tmp/s3iamgw.covdata    (s3 gateway backed by it)
#
# This gives you coverage metrics isolated per test suite / server mode.
#
# -----------------------------------------------------------------------------
# 2) MERGED COVERAGE REPORT (RECOMMENDED)
#
# If you want a unified report combining all environments:
#
#   go tool covdata merge \
#     -i=/tmp/covdata,/tmp/https.covdata,/tmp/versioning.covdata,/tmp/versioning.https.covdata,/tmp/noacl.covdata,/tmp/s3iam.covdata,/tmp/s3iamgw.covdata \
#     -o /tmp/allcovdata
#
#   go tool covdata percent -i=/tmp/allcovdata
#   go tool covdata textfmt -i=/tmp/allcovdata -o /tmp/all_profile.txt
#   go tool cover -html=/tmp/all_profile.txt
#
# This produces the full aggregate coverage across all HTTP/HTTPS,
# versioning-enabled, non-versioning, and no-ACL test runs.
#
# -----------------------------------------------------------------------------