#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

if [ -f "${SCRIPT_DIR}/mqtt-smoke.env" ]; then
  # shellcheck disable=SC1091
  . "${SCRIPT_DIR}/mqtt-smoke.env"
fi

host="${QIPAI_MQTT_HOST:-127.0.0.1}"
port="${QIPAI_MQTT_PORT:-1883}"
protocol="${QIPAI_MQTT_PROTOCOL:-mqtt}"
mqtt_version="${QIPAI_MQTT_VERSION:-3.1.1}"
qos="${QIPAI_MQTT_QOS:-1}"
client_id="qipai-device-smoke-$(date +%s)"
allowed_publish_topic="${QIPAI_MQTT_ALLOWED_PUBLISH_TOPIC:-qipai/${client_id}/status}"
allowed_subscribe_topic="${QIPAI_MQTT_ALLOWED_SUBSCRIBE_TOPIC:-qipai/${client_id}/command/#}"
denied_subscribe_topic="${QIPAI_MQTT_DENIED_SUBSCRIBE_TOPIC:-\$SYS/#}"

echo "INFO: MQTT smoke target ${protocol}://${host}:${port}, version ${mqtt_version}, qos ${qos}"

if ! command -v mqttx >/dev/null 2>&1; then
  echo "FAIL: mqttx CLI not found"
  exit 1
fi

if [ -z "${QIPAI_MQTT_USERNAME:-}" ] || [ -z "${QIPAI_MQTT_PASSWORD:-}" ]; then
  echo "SKIP: QIPAI_MQTT_USERNAME/QIPAI_MQTT_PASSWORD not configured in Git-ignored local env"
  echo "INFO: service-level check remains available via scripts/dev/wsl/check-local-mqtt.sh"
  exit 0
fi

common_args=(
  --hostname "$host"
  --port "$port"
  --protocol "$protocol"
  --mqtt-version "$mqtt_version"
  --qos "$qos"
  --username "$QIPAI_MQTT_USERNAME"
  --password "$QIPAI_MQTT_PASSWORD"
)

echo "INFO: verifying allowed publish topic ${allowed_publish_topic}"
mqttx pub "${common_args[@]}" \
  --client-id "${client_id}-pub" \
  --topic "$allowed_publish_topic" \
  --message "{\"type\":\"smoke\",\"clientId\":\"${client_id}\"}" >/dev/null
echo "PASS: allowed publish accepted"

echo "INFO: verifying allowed subscribe topic ${allowed_subscribe_topic}"
timeout 6 mqttx sub "${common_args[@]}" \
  --client-id "${client_id}-sub" \
  --topic "$allowed_subscribe_topic" \
  --output-mode clean >/tmp/qipai-mqtt-smoke-sub.out 2>/tmp/qipai-mqtt-smoke-sub.err || true
if grep -qiE "error|not authorized|unauthorized|connack.*5|refused" /tmp/qipai-mqtt-smoke-sub.err; then
  echo "FAIL: allowed subscribe was rejected"
  cat /tmp/qipai-mqtt-smoke-sub.err
  exit 1
fi
echo "PASS: allowed subscribe connection did not report authorization failure"

echo "INFO: verifying wrong password is rejected"
if timeout 6 mqttx pub \
  --hostname "$host" \
  --port "$port" \
  --protocol "$protocol" \
  --mqtt-version "$mqtt_version" \
  --qos "$qos" \
  --username "$QIPAI_MQTT_USERNAME" \
  --password "QIPAI_EXPECTED_BAD_PASSWORD" \
  --client-id "${client_id}-badpass" \
  --topic "$allowed_publish_topic" \
  --message "bad-password-should-fail" >/tmp/qipai-mqtt-smoke-badpass.out 2>/tmp/qipai-mqtt-smoke-badpass.err; then
  echo "FAIL: wrong password publish succeeded"
  exit 1
else
  echo "PASS: wrong password rejected"
fi

echo "INFO: probing denied subscribe topic ${denied_subscribe_topic}"
timeout 6 mqttx sub "${common_args[@]}" \
  --client-id "${client_id}-deny" \
  --topic "$denied_subscribe_topic" \
  --output-mode clean >/tmp/qipai-mqtt-smoke-deny.out 2>/tmp/qipai-mqtt-smoke-deny.err || true
if grep -qiE "not authorized|unauthorized|refused|error" /tmp/qipai-mqtt-smoke-deny.err; then
  echo "PASS: denied topic produced authorization error"
else
  echo "WARN: denied topic did not produce a clear authorization error; verify ACL manually"
fi

echo "INFO: will-message and idempotency checks are not automated yet"