#!/usr/bin/env node
// Phase 2A end-to-end test — runs against a live platform/docker-compose.dev.yml stack
// (postgres + egress-proxy + provisioner + identity + gateway). Exercises the full student
// flow through the Gateway, exactly as a browser would, using two students concurrently to
// verify isolation. This is slow (each lab provision is a real k3s cold start, ~1-3 min) and
// deliberately not run on every commit — see platform/README.md for when to run it.
//
// No framework, matching platform/provisioner/test/run.js's convention. Requires:
//   cd platform && docker compose -f docker-compose.dev.yml up -d
//   node test/e2e-phase2a.js
//
// This captures what was verified by hand during Phase 2A implementation (see
// docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md §8) as a repeatable regression script — it is not
// a substitute for the manual real-Lab-image verification (node-pty, terminal, kubectl,
// scenario validation) documented there, which needs a browser/WebSocket client and isn't
// automated here.

const assert = require('assert');

const GW = process.env.GATEWAY_URL || 'http://localhost:4200';
const COHORT = `e2e-test-${Date.now()}`;

async function api(method, path, { studentId, body } = {}) {
  const headers = { 'Content-Type': 'application/json' };
  if (studentId) headers['X-Student-Id'] = studentId;
  const res = await fetch(`${GW}${path}`, { method, headers, body: body ? JSON.stringify(body) : undefined });
  const text = await res.text();
  let json; try { json = JSON.parse(text); } catch { json = text; }
  return { status: res.status, body: json };
}

let passed = 0, failed = 0;
async function test(name, fn) {
  try { await fn(); console.log(`  ok — ${name}`); passed++; }
  catch (e) { console.error(`  FAIL — ${name}\n    ${e.message}`); failed++; }
}

async function main() {
  console.log('Phase 2A end-to-end tests (this is slow — real k3s boots)\n');

  let alice, bob;
  await test('roster: add two students', async () => {
    const a = await api('POST', '/api/roster', { body: { display_name: 'E2E-Alice', cohort: COHORT } });
    const b = await api('POST', '/api/roster', { body: { display_name: 'E2E-Bob', cohort: COHORT } });
    assert.equal(a.status, 200); assert.equal(b.status, 200);
    alice = a.body.student_id; bob = b.body.student_id;
    assert.notEqual(alice, bob);
  });

  await test('roster: cohort listing includes the new cohort', async () => {
    const { body } = await api('GET', `/api/roster?cohort=${COHORT}`);
    assert.equal(body.length, 2);
  });

  await test('login: both students can log in', async () => {
    const a = await api('POST', '/api/login', { body: { student_id: alice } });
    const b = await api('POST', '/api/login', { body: { student_id: bob } });
    assert.equal(a.status, 200); assert.equal(b.status, 200);
  });

  await test('curriculum: path loads with the real RootNode stages, in order', async () => {
    const { body } = await api('GET', '/api/curriculum/path', { studentId: alice });
    const ids = body.stages.map((s) => s.id);
    assert.deepEqual(ids, ['foundation', 'workloads', 'networking', 'configuration', 'troubleshooting', 'real-ops', 'capstone']);
    assert.equal(body.stages.find((s) => s.id === 'capstone').locked, true);
  });

  await test('environment: status is none before launch', async () => {
    const { body } = await api('GET', '/api/environment/status', { studentId: alice });
    assert.equal(body.status, 'none');
  });

  let aliceLaunch, bobLaunch;
  await test('launch: Alice gets a running environment with a launch_path (real k3s boot, be patient)', async () => {
    const { status, body } = await api('POST', '/api/environment/launch', { studentId: alice });
    assert.equal(status, 200);
    assert.equal(body.status, 'running');
    assert.ok(body.launch_path?.startsWith('/lab/'));
    aliceLaunch = body;
  });

  await test('launch: Bob gets a DIFFERENT running environment', async () => {
    const { status, body } = await api('POST', '/api/environment/launch', { studentId: bob });
    assert.equal(status, 200);
    assert.equal(body.status, 'running');
    assert.notEqual(body.launch_path, aliceLaunch.launch_path);
    bobLaunch = body;
  });

  await test('launch: relaunching for Alice reuses the same environment (idempotent)', async () => {
    const { body } = await api('POST', '/api/environment/launch', { studentId: alice });
    assert.equal(body.launch_path, aliceLaunch.launch_path);
  });

  await test('gateway: Alice can reach her own lab', async () => {
    const res = await fetch(`${GW}${aliceLaunch.launch_path}`);
    assert.equal(res.status, 200);
  });

  await test('gateway: an invalid token is rejected (404)', async () => {
    const res = await fetch(`${GW}/lab/not-a-real-token-at-all/`);
    assert.equal(res.status, 404);
  });

  await test('gateway: Alice\'s URL with Bob\'s sid is rejected (cross-student ownership check)', async () => {
    const res = await fetch(`${GW}${aliceLaunch.launch_path}?sid=${bob}`);
    assert.equal(res.status, 403);
  });

  await test('gateway: Alice\'s URL with her own sid succeeds', async () => {
    const res = await fetch(`${GW}${aliceLaunch.launch_path}?sid=${alice}`);
    assert.equal(res.status, 200);
  });

  await test('progress relay: solving a scenario in Alice\'s lab shows up in her curriculum', async () => {
    const scenarioPath = `${aliceLaunch.launch_path}api/scenarios/pod-basics-mcq/answer`;
    await api('POST', scenarioPath, { studentId: alice, body: { selected: 'b' } });
    await new Promise((r) => setTimeout(r, 1500)); // relay is fire-and-forget on the Gateway side
    const { body } = await api('GET', '/api/curriculum/path', { studentId: alice });
    const scenario = body.stages.find((s) => s.id === 'foundation').scenarios.find((sc) => sc.id === 'pod-basics-mcq');
    assert.equal(scenario.status, 'completed');
  });

  await test('progress relay: Bob\'s curriculum is unaffected by Alice\'s answer', async () => {
    const { body } = await api('GET', '/api/curriculum/path', { studentId: bob });
    const scenario = body.stages.find((s) => s.id === 'foundation').scenarios.find((sc) => sc.id === 'pod-basics-mcq');
    assert.notEqual(scenario.status, 'completed');
  });

  await test('reset: Alice\'s lab keeps the same launch_path (stable URL) and her progress survives', async () => {
    const { status, body } = await api('POST', '/api/environment/reset', { studentId: alice });
    assert.equal(status, 200);
    assert.equal(body.launch_path, aliceLaunch.launch_path);
    const { body: curriculum } = await api('GET', '/api/curriculum/path', { studentId: alice });
    const scenario = curriculum.stages.find((s) => s.id === 'foundation').scenarios.find((sc) => sc.id === 'pod-basics-mcq');
    assert.equal(scenario.status, 'completed');
  });

  console.log(`\n${passed} passed, ${failed} failed`);
  console.log('\nNot covered here (needs a browser/WebSocket client — verified manually, see docs/PHASE2A_GATEWAY_AND_STUDENT_FLOW.md §8):');
  console.log('  - real Lab image: node-pty load, terminal WS, kubectl execution');
  console.log('  - idle reaper timing (needs a real threshold wait, or DB manipulation — see the doc)');
  process.exit(failed ? 1 : 0);
}

main().catch((e) => { console.error('Test run crashed:', e); process.exit(1); });