#!/usr/bin/env sh
set -eu

if [ ! -f .env ]; then
  echo "missing .env; copy .env.example and set development values" >&2
  exit 1
fi

set -a
. ./.env
set +a

docker compose down --volumes --remove-orphans
docker compose up --build -d --wait

docker compose exec -T nginx nginx -V 2>&1 |
  grep -q -- '--with-http_auth_request_module'
docker compose exec -T nginx nginx -T 2>&1 |
  grep -q 'proxy_pass_request_body off'

app_container_id="$(docker compose ps -q app)"
published_app_port="$(docker inspect "$app_container_id" \
  --format '{{with (index .NetworkSettings.Ports "8081/tcp")}}{{json .}}{{end}}')"
if [ -n "$published_app_port" ]; then
  echo "backend port 8081 must not be published on the host" >&2
  exit 1
fi

if docker compose exec -T nginx wget -q -O /dev/null \
  --header 'X-Auth-Request-User: spoofed-admin' \
  http://app:8081/edge/me 2>/dev/null; then
  echo "backend accepted a forged identity without the internal token" >&2
  exit 1
fi

npm --prefix e2e ci
E2E_USERNAME=regular-user \
E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
  npm --prefix e2e run test:pattern4

echo "AP4 hardened Nginx auth_request edge flow verified"