#!/bin/bash

################################################################################
# Test Encrypted Environment Setup
# 
# This script tests the encryption/decryption workflow
################################################################################

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"

GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "======================================"
echo "Encrypted Environment Test"
echo "======================================"
echo ""

# Create test .env files
echo -e "${YELLOW}Step 1: Creating test .env files...${NC}"
mkdir -p "$PROJECT_ROOT/test-env"

cat > "$PROJECT_ROOT/test-env/.env" << 'EOF'
# Test Environment File
DB_PASSWORD=TestPassword123!
API_KEY=test-openai-key-placeholder
SESSION_SECRET=test-secret-minimum-32-characters-long
AUTH_PASSWORD=test-auth-pass
EOF

echo "✓ Created test .env file"
cat "$PROJECT_ROOT/test-env/.env"
echo ""

# Test encryption
echo -e "${YELLOW}Step 2: Testing encryption...${NC}"
if [[ $EUID -ne 0 ]]; then
    echo "This test requires root access for encryption"
    echo "Running: sudo..."
fi

sudo bash << 'SUDO_SCRIPT'
set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="/mnt/HC_Volume_103713257/tilbudgivern"
SECURE_DIR="/root/.tilbudgivern-secure"
KEY_FILE="$SECURE_DIR/encryption.key"

# Create secure directory and key if needed
mkdir -p "$SECURE_DIR"
chmod 700 "$SECURE_DIR"

if [[ ! -f "$KEY_FILE" ]]; then
    openssl rand -base64 32 > "$KEY_FILE"
    chmod 600 "$KEY_FILE"
    echo "✓ Generated encryption key"
fi

# Encrypt test file
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 100000 \
    -in "$PROJECT_ROOT/test-env/.env" \
    -out "$PROJECT_ROOT/test-env/.env.enc" \
    -pass file:"$KEY_FILE"

chmod 600 "$PROJECT_ROOT/test-env/.env.enc"
echo "✓ Encrypted test file"
SUDO_SCRIPT

ls -la "$PROJECT_ROOT/test-env/.env.enc"
echo ""

# Remove original
echo -e "${YELLOW}Step 3: Removing plaintext file...${NC}"
rm "$PROJECT_ROOT/test-env/.env"
echo "✓ Removed plaintext .env"
echo ""

# Test decryption
echo -e "${YELLOW}Step 4: Testing decryption...${NC}"
sudo bash << 'SUDO_SCRIPT'
set -e

PROJECT_ROOT="/mnt/HC_Volume_103713257/tilbudgivern"
KEY_FILE="/root/.tilbudgivern-secure/encryption.key"

# Decrypt
openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 \
    -in "$PROJECT_ROOT/test-env/.env.enc" \
    -out "$PROJECT_ROOT/test-env/.env" \
    -pass file:"$KEY_FILE"

chmod 600 "$PROJECT_ROOT/test-env/.env"
chown alex:alex "$PROJECT_ROOT/test-env/.env"
echo "✓ Decrypted test file"
SUDO_SCRIPT

echo "Decrypted content:"
cat "$PROJECT_ROOT/test-env/.env"
echo ""

# Verify content
echo -e "${YELLOW}Step 5: Verifying content...${NC}"
if grep -q "TestPassword123!" "$PROJECT_ROOT/test-env/.env"; then
    echo -e "${GREEN}✓ Password verified${NC}"
else
    echo -e "${RED}✗ Password mismatch${NC}"
    exit 1
fi

if grep -q "test-openai-key-placeholder" "$PROJECT_ROOT/test-env/.env"; then
    echo -e "${GREEN}✓ API key verified${NC}"
else
    echo -e "${RED}✗ API key mismatch${NC}"
    exit 1
fi

echo ""

# Cleanup
echo -e "${YELLOW}Step 6: Cleanup...${NC}"
rm -f "$PROJECT_ROOT/test-env/.env"
rm -f "$PROJECT_ROOT/test-env/.env.enc"
rmdir "$PROJECT_ROOT/test-env" 2>/dev/null || true
echo "✓ Cleaned up test files"
echo ""

echo "======================================"
echo -e "${GREEN}✅ All tests passed!${NC}"
echo "======================================"
echo ""
echo "The encryption/decryption system is working correctly."
echo "You can now use:"
echo "  - sudo ./scripts/setup-encrypted-env.sh"
echo "  - sudo ./scripts/decrypt-env.sh"
echo ""