#!/usr/bin/env bash
# DeepData × Casdoor SSO 全链路 E2E 检查（在能同时访问网关与 Casdoor 的机器上运行）
#
# 用法:
#   GW_BASE=https://deepdata.yhdd.apescale.com:1014 \
#   CASDOOR_BASE=http://192.168.31.23:1013 \
#   SSO_CLIENT_ID=<clientId> SSO_CLIENT_SECRET=<secret> \
#   LOCAL_ADMIN_PASSWORD=*** \
#   bash e2e-check.sh
#
# 可选环境变量（有默认值，按实际部署修改）:
#   SSO_APP_NAME=DataMate            Casdoor 应用名
#   SSO_APP_OWNER=admin              Casdoor 应用 owner（grant-consent 需 owner/name 全名）
#   SSO_ORG=datamate                 Casdoor 组织名（登录用）
#   SSO_REDIRECT_URI=$GW_BASE/api/user/oauth/callback
#   SSO_TEST_USERS="dmin:Dmin@2026:admin viewer1:Viewer1@2026:viewer"   用户名:密码:期望角色
#   LOCAL_ADMIN=admin                本地管理员（验证本地登录共存）
set -u

GW="${GW_BASE:?GW_BASE required, e.g. https://deepdata.yhdd.apescale.com:1014}"
CD="${CASDOOR_BASE:?CASDOOR_BASE required, e.g. http://192.168.31.23:1013}"
APP="${SSO_APP_NAME:-DataMate}"
APP_FULL="${SSO_APP_OWNER:-admin}/$APP"
ORG="${SSO_ORG:-datamate}"
REDIR="${SSO_REDIRECT_URI:-$GW/api/user/oauth/callback}"
CLIENT_ID="${SSO_CLIENT_ID:?SSO_CLIENT_ID required}"
ADMIN_U="${LOCAL_ADMIN:-admin}"
ADMIN_P="${LOCAL_ADMIN_PASSWORD:*** LOCAL_ADMIN_PASSWORD required}"

TMPD=$(mktemp -d); trap 'rm -rf "$TMPD"' EXIT
fail=0
ck() { if [ "$1" = "0" ]; then echo "PASS: $2"; else echo "FAIL: $2"; fail=1; fi; }

echo "=== [1] /sso/casdoor/config ==="
CFG=$(curl -sk "$GW/sso/casdoor/config")
echo "$CFG"
echo "$CFG" | grep -q '"enabled":true' && ck 0 "enabled=true" || ck 1 "enabled"
# clientSecret 不得出现在公开配置里
if [ -n "${SSO_CLIENT_SECRET:-}" ] && echo "$CFG" | grep -q "$SSO_CLIENT_SECRET"; then
  ck 1 "clientSecret 泄漏"; else ck 0 "无 secret 泄漏"; fi

echo "=== [2] 本地登录 $ADMIN_U（accountOnly 已移除，本地登录与 SSO 共存）==="
LOGIN=$(curl -sk -X POST "$GW/api/user/login" -H 'Content-Type: application/json' \
  -d "{\"username\":\"$ADMIN_U\",\"password\":\"$ADMIN_P\"}")
TOK=$(echo "$LOGIN" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
[ -n "$TOK" ] && ck 0 "本地登录拿 token" || { echo "$LOGIN"; ck 1 "本地登录"; }
ME=$(curl -sk "$GW/api/user/me" -H "Authorization: Bearer $TOK")
echo "$ME"

# SSO 单用户链路: 网关登录页 → casdoor JSON 登录 → grant-consent 取 code → 网关 callback → /me
sso_test() {
  local U="$1" P="$2" EXPECT="$3"
  local GJ="$TMPD/gw_$U" CJ="$TMPD/cd_$U" HDRS AUTHURL STATE LR CODE CB FINAL SSTOK ME2
  HDRS=$(curl -sk -c "$GJ" -D - -o /dev/null "$GW/api/user/oauth/login?next=/sso/callback.html")
  AUTHURL=$(echo "$HDRS" | grep -i '^location:' | tr -d '\r' | awk '{print $2}')
  STATE=$(echo "$AUTHURL" | sed -n 's/.*state=\([^&]*\).*/\1/p')
  [ -n "$AUTHURL" ] && [ -n "$STATE" ] && ck 0 "$U 拿到 authorize URL" || { echo "authurl=$AUTHURL"; ck 1 "$U authorize"; return; }
  LR=$(curl -s -c "$CJ" -X POST -H 'Content-Type: application/json' \
    -d "{\"type\":\"login\",\"application\":\"$APP\",\"username\":\"$U\",\"password\":\"$P\",\"organization\":\"$ORG\",\"autoSignin\":true}" \
    "$CD/api/login")
  echo "$LR" | grep -q '"status": *"ok"' && ck 0 "$U casdoor 登录" || { echo "$LR"; ck 1 "$U casdoor 登录"; return; }
  CODE=$(curl -s -b "$CJ" -X POST -H 'Content-Type: application/json' \
    -d "{\"application\":\"$APP_FULL\",\"clientId\":\"$CLIENT_ID\",\"provider\":\"\",\"signinMethod\":\"\",\"responseType\":\"code\",\"redirectUri\":\"$REDIR\",\"scope\":\"openid profile email\",\"state\":\"$STATE\",\"nonce\":\"\",\"challenge\":\"\",\"resource\":\"\"}" \
    "$CD/api/grant-consent" | sed -n 's/.*"data": *"\([^"]*\)".*/\1/p')
  [ -n "$CODE" ] && ck 0 "$U 拿到 authorization code" || { ck 1 "$U grant-consent"; return; }
  CB=$(curl -sk -b "$GJ" -D - -o /dev/null "$GW/api/user/oauth/callback?code=$CODE&state=$STATE")
  FINAL=$(echo "$CB" | grep -i '^location:' | tr -d '\r' | awk '{print $2}')
  echo "final: $FINAL"
  SSTOK=$(echo "$FINAL" | sed -n 's/.*sso_token=//p')
  [ -n "$SSTOK" ] && ck 0 "$U 拿到 sso_token" || { echo "$CB" | head -5; ck 1 "$U sso_token"; return; }
  ME2=$(curl -sk "$GW/api/user/me" -H "Authorization: Bearer $SSTOK")
  echo "$ME2"
  echo "$ME2" | grep -q "\"role\":\"$EXPECT\"" && ck 0 "$U 角色=$EXPECT" || ck 1 "$U 角色（期望 $EXPECT）"
}

i=3
for entry in ${SSO_TEST_USERS:-}; do
  U="${entry%%:*}"; rest="${entry#*:}"; P="${rest%%:*}"; EXPECT="${rest#*:}"
  echo "=== [$i] SSO $U → $EXPECT ==="
  sso_test "$U" "$P" "$EXPECT"
  i=$((i+1))
done

echo ""
echo "=== 汇总 fail=$fail ==="
exit "$fail"