#!/usr/bin/env bash
set -euo pipefail

# PCIe real-card smoke test template for internal crypto APIs.
# Fill env vars below, then run:
#   chmod +x scripts/pcie_realcard_smoke.sh
#   ./scripts/pcie_realcard_smoke.sh

BASE_URL="${BASE_URL:-http://127.0.0.1:8080}"
INTERNAL_TOKEN="${INTERNAL_TOKEN:-change-me-internal-token}"
TIMEOUT_SECONDS="${TIMEOUT_SECONDS:-15}"

# Common algorithm IDs (GM/T 0018 style)
ALG_SM3="${ALG_SM3:-1}"       # digest/hmac
ALG_SM4_ECB="${ALG_SM4_ECB:-1025}"  # 0x00000401, symmetric encrypt/decrypt

# Test payloads
PLAINTEXT_B64="${PLAINTEXT_B64:-dG1zLXBjaWUtc21va2U=}"     # "tms-pcie-smoke"
KEY_16_B64="${KEY_16_B64:-MDEyMzQ1Njc4OWFiY2RlZg==}"       # "0123456789abcdef"
IV_B64="${IV_B64:-}"                                       # ECB can keep empty

pass_count=0
fail_count=0

require_cmd() {
  local cmd="$1"
  if ! command -v "$cmd" >/dev/null 2>&1; then
    echo "[FATAL] command not found: $cmd"
    exit 1
  fi
}

api_get() {
  local path="$1"
  curl -sS --max-time "${TIMEOUT_SECONDS}" \
    -H "X-Internal-Token: ${INTERNAL_TOKEN}" \
    "${BASE_URL}${path}"
}

api_post() {
  local path="$1"
  local body="$2"
  curl -sS --max-time "${TIMEOUT_SECONDS}" \
    -H "Content-Type: application/json" \
    -H "X-Internal-Token: ${INTERNAL_TOKEN}" \
    -X POST \
    "${BASE_URL}${path}" \
    -d "${body}"
}

assert_success() {
  local name="$1"
  local resp="$2"
  if echo "${resp}" | jq -e '.success == true and .code == 200' >/dev/null 2>&1; then
    echo "[PASS] ${name}"
    pass_count=$((pass_count + 1))
  else
    echo "[FAIL] ${name}"
    echo "  response: ${resp}"
    fail_count=$((fail_count + 1))
  fi
}

run_case_get() {
  local name="$1"
  local path="$2"
  local resp
  resp="$(api_get "${path}")"
  assert_success "${name}" "${resp}"
}

run_case_post() {
  local name="$1"
  local path="$2"
  local body="$3"
  local resp
  resp="$(api_post "${path}" "${body}")"
  assert_success "${name}" "${resp}"
}

main() {
  require_cmd curl
  require_cmd jq

  echo "[INFO] BASE_URL=${BASE_URL}"
  echo "[INFO] starting smoke tests..."

  run_case_get "device-count" "/api/v1/device/crypto/device-count"
  run_case_get "device-info" "/api/v1/device/crypto/device-info"
  run_case_post "self-test" "/api/v1/device/crypto/self-test" "{}"
  run_case_get "random-16" "/api/v1/device/crypto/random?length=16"

  run_case_post "digest-sm3" "/api/v1/device/crypto/digest" "$(cat <<JSON
{"algId":${ALG_SM3},"dataBase64":"${PLAINTEXT_B64}","outBufferSize":64}
JSON
)"

  run_case_post "hmac-sm3" "/api/v1/device/crypto/hmac" "$(cat <<JSON
{"algId":${ALG_SM3},"keyBase64":"${KEY_16_B64}","dataBase64":"${PLAINTEXT_B64}"}
JSON
)"

  run_case_post "encrypt-plain-sm4" "/api/v1/device/crypto/encrypt/plain" "$(cat <<JSON
{"algId":${ALG_SM4_ECB},"keyBase64":"${KEY_16_B64}","ivBase64":"${IV_B64}","dataBase64":"${PLAINTEXT_B64}","outBufferSize":256}
JSON
)"

  run_case_post "kek-generate-128" "/api/v1/device/crypto/kek/generate" '{"keyBits":128,"keyIndex":1}'
  run_case_get "kek-status-1" "/api/v1/device/crypto/kek/status?keyIndex=1"
  run_case_get "lmk-seed-mac" "/api/v1/device/crypto/lmk/seed-mac"

  echo "[INFO] smoke tests completed: pass=${pass_count}, fail=${fail_count}"
  if [ "${fail_count}" -gt 0 ]; then
    exit 2
  fi
}

main "$@"