#!/usr/bin/env bash
# Live curl scenarios for Option B signup.
# Start API first (SMTP must not block local tests):
#   cd api/public && MAIL_MAILER=log php -S 127.0.0.1:8000 ../vendor/laravel/framework/src/Illuminate/Foundation/resources/server.php
# Local OTP is always 123456 (see OtpService).
set -euo pipefail

BASE="http://127.0.0.1:8000/api/v1"
OTP="123456"
RUN_ID="${RUN_ID:-$(date +%s)}"

hdr=(-H "Content-Type: application/json" -H "Accept: application/json")

pretty() {
  if command -v jq >/dev/null 2>&1; then jq . 2>/dev/null || cat; else cat; fi
}

section() {
  echo ""
  echo "================================================================"
  echo " $1"
  echo "================================================================"
}

# --- Scenario 1: Fresh borrower (full funnel) ---
section "SCENARIO 1: Fresh borrower signup (4-step funnel)"
B_EMAIL="curl_borrower_${RUN_ID}@scenario.test"
B_PHONE="080$(printf '%08d' $((RUN_ID % 100000000)))"

echo ">> POST /auth/initiate-signup"
INIT=$(curl -s -w "\nHTTP:%{http_code}" -X POST "${BASE}/auth/initiate-signup" "${hdr[@]}" \
  -d "{\"email\":\"${B_EMAIL}\",\"phoneNumber\":\"${B_PHONE}\"}")
echo "$INIT" | sed '$d' | pretty
INIT_CODE=$(echo "$INIT" | tail -1 | sed 's/HTTP://')
REF=$(echo "$INIT" | sed '$d' | jq -r '.referenceId // empty' 2>/dev/null || true)

echo ">> POST /auth/verify-otp (OTP=${OTP})"
VERIFY=$(curl -s -w "\nHTTP:%{http_code}" -X POST "${BASE}/auth/verify-otp" "${hdr[@]}" \
  -d "{\"email\":\"${B_EMAIL}\",\"otp\":\"${OTP}\",\"referenceId\":\"${REF}\"}")
echo "$VERIFY" | sed '$d' | pretty
TOKEN=$(echo "$VERIFY" | sed '$d' | jq -r '.signupToken // empty' 2>/dev/null || true)

echo ">> POST /auth/update-profile"
PROFILE=$(curl -s -w "\nHTTP:%{http_code}" -X POST "${BASE}/auth/update-profile" "${hdr[@]}" \
  -d "{\"signupToken\":\"${TOKEN}\",\"firstName\":\"Curl\",\"lastName\":\"Borrower\",\"dob\":\"1992-01-01\",\"stateOfOrigin\":\"Lagos\",\"lga\":\"Ikeja\",\"address\":\"1 Test St\",\"occupation\":\"Dev\"}")
echo "$PROFILE" | sed '$d' | pretty

echo ">> POST /auth/create-password"
CREATE=$(curl -s -w "\nHTTP:%{http_code}" -X POST "${BASE}/auth/create-password" "${hdr[@]}" \
  -d "{\"signupToken\":\"${TOKEN}\",\"password\":\"password123\"}")
echo "$CREATE" | sed '$d' | pretty
echo "HTTP: $(echo "$CREATE" | tail -1 | sed 's/HTTP://')"

echo ">> POST /auth/user/login (login_type=borrower)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/user/login" "${hdr[@]}" \
  -d "{\"email\":\"${B_EMAIL}\",\"password\":\"password123\",\"login_type\":\"borrower\"}" | sed '$d' | pretty

# --- Scenario 2: Fresh affiliate ---
section "SCENARIO 2: Fresh affiliate signup"
A_EMAIL="curl_affiliate_${RUN_ID}@scenario.test"
A_PHONE="081$(printf '%08d' $(( (RUN_ID + 1) % 100000000)))"

curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/user/register" "${hdr[@]}" \
  -d "{\"name\":\"Curl Partner\",\"email\":\"${A_EMAIL}\",\"password\":\"password123\",\"phone\":\"${A_PHONE}\",\"type\":\"affiliate\",\"state\":\"Lagos\"}" | sed '$d' | pretty

# --- Scenario 3: Duplicate borrower blocked ---
section "SCENARIO 3: Duplicate borrower blocked (same email as scenario 1)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/initiate-signup" "${hdr[@]}" \
  -d "{\"email\":\"${B_EMAIL}\",\"phoneNumber\":\"${B_PHONE}\"}" | pretty

# --- Scenario 4: Duplicate affiliate blocked ---
section "SCENARIO 4: Duplicate affiliate blocked (same email as scenario 2)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/user/register" "${hdr[@]}" \
  -d "{\"name\":\"Duplicate\",\"email\":\"${A_EMAIL}\",\"password\":\"password123\",\"phone\":\"${A_PHONE}\",\"type\":\"affiliate\"}" | pretty

# --- Scenario 5: Borrower → Affiliate upgrade ---
section "SCENARIO 5: Borrower → Affiliate upgrade (same account as scenario 1)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/user/register" "${hdr[@]}" \
  -d "{\"name\":\"Dual Partner\",\"email\":\"${B_EMAIL}\",\"password\":\"newpass123\",\"phone\":\"${B_PHONE}\",\"type\":\"affiliate\"}" | sed '$d' | pretty

echo ">> Login borrower app with new password"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/user/login" "${hdr[@]}" \
  -d "{\"email\":\"${B_EMAIL}\",\"password\":\"newpass123\",\"login_type\":\"borrower\"}" | sed '$d' | pretty

echo ">> Login affiliate app (expect 403 pending review)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/user/login" "${hdr[@]}" \
  -d "{\"email\":\"${B_EMAIL}\",\"password\":\"newpass123\",\"login_type\":\"affiliate\"}" | pretty

# --- Scenario 6: Affiliate → Borrower upgrade ---
section "SCENARIO 6: Affiliate → Borrower upgrade (full funnel on scenario 2 affiliate)"
echo ">> POST /auth/initiate-signup (affiliate email allowed)"
INIT2=$(curl -s -w "\nHTTP:%{http_code}" -X POST "${BASE}/auth/initiate-signup" "${hdr[@]}" \
  -d "{\"email\":\"${A_EMAIL}\",\"phoneNumber\":\"${A_PHONE}\"}")
echo "$INIT2" | sed '$d' | pretty
REF2=$(echo "$INIT2" | sed '$d' | jq -r '.referenceId // empty' 2>/dev/null || true)

VERIFY2=$(curl -s -X POST "${BASE}/auth/verify-otp" "${hdr[@]}" \
  -d "{\"email\":\"${A_EMAIL}\",\"otp\":\"${OTP}\",\"referenceId\":\"${REF2}\"}")
TOKEN2=$(echo "$VERIFY2" | jq -r '.signupToken // empty' 2>/dev/null || true)

curl -s -X POST "${BASE}/auth/update-profile" "${hdr[@]}" \
  -d "{\"signupToken\":\"${TOKEN2}\",\"firstName\":\"Curl\",\"lastName\":\"AffiliateBorrower\",\"dob\":\"1990-05-05\",\"stateOfOrigin\":\"Abuja\",\"lga\":\"Gwagwalada\",\"address\":\"2 Partner Rd\",\"occupation\":\"Agent\"}" >/dev/null

echo ">> POST /auth/create-password (expect registration_mode: upgraded)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/create-password" "${hdr[@]}" \
  -d "{\"signupToken\":\"${TOKEN2}\",\"password\":\"password456\"}" | sed '$d' | pretty

# --- Scenario 7: Email/phone mismatch ---
section "SCENARIO 7: Email from one user + phone from another → 422"
M_EMAIL_A="curl_mismatch_a_${RUN_ID}@scenario.test"
M_EMAIL_B="curl_mismatch_b_${RUN_ID}@scenario.test"
M_PHONE_A="082$(printf '%08d' $(( (RUN_ID + 2) % 100000000)))"
M_PHONE_B="083$(printf '%08d' $(( (RUN_ID + 3) % 100000000)))"

curl -s -X POST "${BASE}/auth/user/register" "${hdr[@]}" \
  -d "{\"name\":\"User A\",\"email\":\"${M_EMAIL_A}\",\"password\":\"password123\",\"phone\":\"${M_PHONE_A}\",\"type\":\"affiliate\"}" >/dev/null

(cd "$(dirname "$0")/.." && php artisan tinker --execute="
\App\Domains\Auth\Models\User::create([
  'name' => 'User B',
  'email' => '${M_EMAIL_B}',
  'password' => bcrypt('password123'),
  'phone' => '${M_PHONE_B}',
  'type' => 'borrower',
  'email_verified' => true,
])->markBorrowerRegistered();
" >/dev/null 2>&1)

echo ">> POST /auth/initiate-signup email=${M_EMAIL_A} phone=${M_PHONE_B} (A's email + B's phone)"
curl -s -w "\nHTTP:%{http_code}\n" -X POST "${BASE}/auth/initiate-signup" "${hdr[@]}" \
  -d "{\"email\":\"${M_EMAIL_A}\",\"phoneNumber\":\"${M_PHONE_B}\"}" | pretty

section "DONE — emails used: ${B_EMAIL}, ${A_EMAIL}"