#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PACKAGE_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
SECRETS_ENV=""
CREDENTIAL_CHECK=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --secrets-env) SECRETS_ENV="$2"; shift 2 ;;
    --credential-check) CREDENTIAL_CHECK=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"

FAILURES=0
run_check() {
  local label="$1"
  shift
  if "$@" >/dev/null 2>&1; then
    printf 'PASS\t%s\n' "$label"
  else
    printf 'FAIL\t%s\n' "$label"
    FAILURES=$((FAILURES + 1))
  fi
}

run_check "mqtt_dns" getent hosts "$ALIYUN_MQTT_ENDPOINT"
run_check "mqtt_tcp" network_tcp_check "$ALIYUN_MQTT_ENDPOINT" "$ALIYUN_MQTT_PORT"
run_check "baidu_https" curl -sS --connect-timeout 5 --max-time 10 "$BAIDU_FACE_API_BASE/"
run_check "oss_https" curl -sS --connect-timeout 5 --max-time 10 "$ALIYUN_OSS_PUBLIC_HOST"

if [ "$CREDENTIAL_CHECK" -eq 1 ]; then
  [ -n "$SECRETS_ENV" ] || die "--secrets-env is required for credential check"
  require_secret_permissions "$SECRETS_ENV"
  assert_no_placeholders "$SECRETS_ENV"
  run_check "baidu_credential" python3 "$PACKAGE_ROOT/tools/baidu_credential_check.py" --secrets-env "$SECRETS_ENV"
  printf 'PENDING\tmqtt_credential_requires_application_publish_subscribe_test\n'
  printf 'PENDING\toss_credential_requires_application_sdk_read_test\n'
fi

printf 'FAIL_COUNT=%s\n' "$FAILURES"
[ "$FAILURES" -eq 0 ]