<?php

/** Live routing checks. Temporary unbound mini identity is removed in finally; no business writes. */
require dirname(__DIR__) . '/vendor/autoload.php';
\Dotenv\Dotenv::createUnsafeMutable(dirname(__DIR__))->load();
\support\App::loadAllConfig(['route']);
date_default_timezone_set('Asia/Shanghai');

use app\miniapi\service\AuthService;
use app\miniapi\model\MiniUser;
use app\miniapi\model\MiniSession;

$checks = 0;
function verify(bool $condition, string $label): void
{
    global $checks;
    $checks++;
    if (!$condition) {
        throw new RuntimeException($label);
    }
}
function requestApi(string $method, string $path, int $status, int $code, ?string $token = null, string $payload = '{}'): array
{
    $headers = ['Content-Type: application/json'];
    if ($token !== null) {
        $headers[] = 'Authorization: Bearer ' . $token;
    }
    $curl = curl_init('http://127.0.0.1:8787' . $path);
    curl_setopt_array($curl, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 10, CURLOPT_CUSTOMREQUEST => $method, CURLOPT_HTTPHEADER => $headers]);
    if ($method === 'POST') {
        curl_setopt($curl, CURLOPT_POSTFIELDS, $payload);
    }
    $raw = curl_exec($curl);
    $actual = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    curl_close($curl);
    $data = json_decode((string) $raw, true);
    verify($actual === $status && ($data['code'] ?? null) === $code, "$method $path expected $status/$code got $actual/" . ($data['code'] ?? 'invalid JSON'));
    verify(isset($data['request_id']) && array_key_exists('data', $data), "$path response envelope");

    return $data['data'] ?? [];
}
$base = '/api/mini/v1';
$configuration = requestApi('GET', $base . '/config', 200, 0);
verify(!$configuration['capabilities']['payment'], 'payments not fabricated');
$catalog = requestApi('GET', $base . '/packages?page_size=1', 200, 0);
verify(isset($catalog['items'], $catalog['total']), 'live catalog list');
if ($catalog['items']) {
    requestApi('GET', $base . '/packages/' . $catalog['items'][0]['id'], 200, 0);
}
requestApi('POST', $base . '/auth/wechat', 400, 40001, null, '[');
requestApi('POST', $base . '/auth/wechat', 422, 42201, null, '{"code":"unused","user_id":1}');
if (!$configuration['capabilities']['wechat_login']) {
    requestApi('POST', $base . '/auth/wechat', 503, 50301, null, '{"code":"unused"}');
}
$getPaths = ['/me', '/addresses', '/enterprises/1/address', '/enterprises/1/home', '/enterprises/1/rights', '/enterprises/1/ledger', '/enterprises/1/orders', '/enterprises/1/devices', '/enterprises/1/rewards', '/enterprises/1/devices/1', '/enterprises/1/deliveries/1', '/enterprises/1/checkouts/1', '/drivers/1/dashboard', '/drivers/1/tasks', '/drivers/1/routes', '/drivers/1/tasks/1', '/drivers/1/tasks/1/device-check?sn=test', '/photos/1?scope=enterprise&resource_id=1', '/agents/1/dashboard', '/agents/1/customers', '/agents/1/orders', '/agents/1/commissions'];
$postPaths = ['/auth/logout', '/enterprises/1/address', '/enterprises/1/deliveries', '/enterprises/1/deliveries/1/cancel', '/enterprises/1/checkout/quote', '/enterprises/1/checkouts', '/enterprises/1/checkouts/1/cancel', '/enterprises/1/checkouts/1/pay', '/drivers/1/tasks/1/start', '/drivers/1/tasks/1/checkin', '/drivers/1/tasks/1/draft', '/drivers/1/tasks/1/complete', '/drivers/1/tasks/1/exception', '/drivers/1/tasks/1/photos', '/agents/1/withdrawals'];
foreach ($getPaths as $path) {
    requestApi('GET', $base . $path, 401, 40101);
}
foreach ($postPaths as $path) {
    requestApi('POST', $base . $path, 401, 40101);
}
$session = (new AuthService())->issue(['appid' => 'http-test-' . bin2hex(random_bytes(8)), 'openid' => 'unbound']);
try {
    $token = $session['access_token'];
    $profile = requestApi('GET', $base . '/me', 200, 0, $token);
    verify($profile['identities'] === [], 'HTTP login alone grants no role');
    $addresses = requestApi('GET', $base . '/addresses', 200, 0, $token);
    verify($addresses['items'] === [], 'HTTP unbound user has no enterprise');
    foreach (['/enterprises/1/home', '/enterprises/1/address', '/drivers/1/tasks/1', '/agents/1/dashboard'] as $path) {
        requestApi('GET', $base . $path, 403, 40301, $token);
    }
    requestApi('POST', $base . '/enterprises/1/checkouts', 403, 40301, $token, '{"items":[{"package_id":1,"quantity":1}]}');
    requestApi('POST', $base . '/auth/logout', 200, 0, $token);
    requestApi('GET', $base . '/me', 401, 40101, $token);
    foreach (['/miniapi/enterprise/addresses', '/miniapi/photo/photo', '/miniapi/driver/taskCommand'] as $path) {
        $curl = curl_init('http://127.0.0.1:8787' . $path);
        curl_setopt_array($curl, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 10]);
        curl_exec($curl);
        verify(curl_getinfo($curl, CURLINFO_HTTP_CODE) !== 200, 'implicit route disabled: ' . $path);
        curl_close($curl);
    }
} finally {
    MiniSession::query()->where('user_id', $session['user_id'])->delete();
    MiniUser::query()->where('id', $session['user_id'])->delete();
}
verify(!MiniUser::query()->where('id', $session['user_id'])->exists(), 'HTTP test user cleaned up');
echo "PASS: $checks live mini HTTP checks; temporary identity removed.\n";