#!/usr/bin/env bash
# TW-301 — Smoke AdCenter v1 with a level-1 X-API-KEY only.
#
# Usage:
#   export ADCENTER_LEVEL1_API_KEY='<level-1-key>'
#   # optional overrides:
#   export ADCENTER_API_BASE_URL=https://apiad.admedia.com/v1
#   export ADCENTER_CAMPAIGN_ID=<id>
#   export ADCENTER_CREATIVE_ID=<id>
#   export ADCENTER_REPORT_FROM=2026-07-01
#   export ADCENTER_REPORT_TO=2026-07-31
#   ./scripts/smoke-adcenter-level1.sh
#
# Also verifies Lucos header policy helpers reject Basic / X-API-ADVID
# via unit tests when RUN_LUCOS_AUTH_UNIT_TESTS=1 (default).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
BASE="${ADCENTER_API_BASE_URL:-https://apiad.admedia.com/v1}"
BASE="${BASE%/}"
FROM="${ADCENTER_REPORT_FROM:-$(date -u -v-30d +%Y-%m-%d 2>/dev/null || date -u -d '30 days ago' +%Y-%m-%d)}"
TO="${ADCENTER_REPORT_TO:-$(date -u +%Y-%m-%d)}"

if [[ -z "${ADCENTER_LEVEL1_API_KEY:-}" ]]; then
  echo "FAIL: set ADCENTER_LEVEL1_API_KEY to a dedicated level-1 key (never commit it)."
  echo "      Mint via scripts/mint-adcenter-level1-key.sh or AdOps (docs/ADCENTER-LEVEL1-OPS.md)."
  exit 1
fi

auth_curl() {
  local path="$1"
  shift
  curl -sS -w '\n%{http_code}' "$@" \
    -H "X-API-KEY: ${ADCENTER_LEVEL1_API_KEY}" \
    -H "Accept: application/json" \
    "${BASE}${path}"
}

echo "==> Smoke base=${BASE}"

# 1) Campaigns list / optional id
if [[ -n "${ADCENTER_CAMPAIGN_ID:-}" ]]; then
  echo "==> GET /campaigns?id=${ADCENTER_CAMPAIGN_ID}"
  RESP="$(auth_curl "/campaigns?id=${ADCENTER_CAMPAIGN_ID}")"
else
  echo "==> GET /campaigns (list — discover fixture campaign_id)"
  RESP="$(auth_curl "/campaigns")"
fi
BODY="$(echo "${RESP}" | sed '$d')"
CODE="$(echo "${RESP}" | tail -n1)"
if [[ "${CODE}" != "200" ]]; then
  echo "FAIL: campaigns HTTP ${CODE}"
  echo "${BODY}" | head -c 400; echo
  exit 1
fi
echo "OK: campaigns ${CODE}"

DISCOVERED_CAMPAIGN="$(echo "${BODY}" | node -e "
let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{
  try {
    const j=JSON.parse(d);
    const row=Array.isArray(j)?j[0]:(j.data&&j.data[0])||j;
    const id=row&& (row.id||row.campaign_id);
    process.stdout.write(id!=null?String(id):'');
  } catch { process.stdout.write(''); }
});")"
if [[ -n "${DISCOVERED_CAMPAIGN}" ]]; then
  echo "    discovered_campaign_id=${DISCOVERED_CAMPAIGN}"
fi

# 2) Creative optional
CREATIVE_ID="${ADCENTER_CREATIVE_ID:-}"
if [[ -n "${CREATIVE_ID}" ]]; then
  echo "==> GET /creatives?id=${CREATIVE_ID}"
  RESP="$(auth_curl "/creatives?id=${CREATIVE_ID}")"
  BODY="$(echo "${RESP}" | sed '$d')"
  CODE="$(echo "${RESP}" | tail -n1)"
  if [[ "${CODE}" != "200" ]]; then
    echo "FAIL: creatives HTTP ${CODE}"
    exit 1
  fi
  echo "OK: creatives ${CODE}"
else
  echo "==> SKIP creatives (set ADCENTER_CREATIVE_ID to exercise)"
fi

# 3) Report summary (Lucos allowlisted path)
echo "==> GET /reports/summary/daily?from=${FROM}&to=${TO}"
RESP="$(auth_curl "/reports/summary/daily?from=${FROM}&to=${TO}")"
BODY="$(echo "${RESP}" | sed '$d')"
CODE="$(echo "${RESP}" | tail -n1)"
if [[ "${CODE}" != "200" ]]; then
  echo "FAIL: reports/summary HTTP ${CODE}"
  echo "${BODY}" | head -c 400; echo
  exit 1
fi
echo "OK: reports/summary ${CODE}"

# 4) Lucos must never send Basic / X-API-ADVID — unit-test evidence
if [[ "${RUN_LUCOS_AUTH_UNIT_TESTS:-1}" == "1" ]]; then
  echo "==> Lucos assertSafeAdCenterAuth unit tests (level-10 path rejected)"
  (
    cd "${ROOT}"
    npm test -- --testPathPattern=tool-credentials.service.test.js --forceExit
  )
fi

echo "PASS: AdCenter level-1 smoke + Lucos level-10 rejection evidence"
echo "      Update docs/fixtures/adcenter-staging.json sample_ids with discovered IDs only."