#!/usr/bin/env bash
set -euo pipefail

BASE_URL="${BASE_URL:-https://wx.sstbc.com}"
CURL_TIMEOUT="${CURL_TIMEOUT:-20}"
CURL_RESOLVE="${CURL_RESOLVE:-}"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

CURL_ARGS=(-sS -L --max-time "$CURL_TIMEOUT")
if [[ "${CURL_INSECURE:-0}" == "1" ]]; then CURL_ARGS+=(-k); fi
if [[ -n "$CURL_RESOLVE" ]]; then CURL_ARGS+=(--resolve "$CURL_RESOLVE"); fi

request() {
    local name="$1"
    local method="$2"
    local path="$3"
    local payload="${4:-{\"mobile\":\"13800138000\",\"code\":\"1234\",\"challenge_id\":\"not-a-uuid\"}}"
    local body="$TMP_DIR/$name.json"
    local status

    if ! status="$(curl "${CURL_ARGS[@]}" -X "$method" -H 'Accept: application/json' -H 'Content-Type: application/json' \
        -d "$payload" \
        -o "$body" -w '%{http_code}' "$BASE_URL$path")"; then
        status="000"
    fi
    printf '%-32s HTTP %s\n' "$name" "$status"
    printf '%s\n' "$body"
    printf '%s' "$status" > "$TMP_DIR/$name.status"
}

request legacy-login GET /api/admin/auth/sms-login
request legacy-send GET /api/admin/auth/send-sms
request invalid-login POST /api/admin/auth/sms-login
request invalid-send POST /api/admin/auth/send-sms '{"mobile":"invalid"}'

if [[ "$(cat "$TMP_DIR/legacy-login.status")" != "405" || "$(cat "$TMP_DIR/legacy-send.status")" != "405" ]]; then
    printf 'LEGACY_GET_CLOSED FAIL\n'
    exit 1
fi
printf 'LEGACY_GET_CLOSED PASS\n'

if ! grep -Eq '"errcode"[[:space:]]*:[[:space:]]*30001' "$TMP_DIR/invalid-login.json"; then
    printf 'LOGIN_VALIDATION FAIL\n'
    exit 1
fi
if grep -Eiq 'access_token|token' "$TMP_DIR/invalid-login.json"; then
    printf 'LOGIN_TOKEN_LEAK FAIL\n'
    exit 1
fi
printf 'LOGIN_VALIDATION PASS\n'

if ! grep -Eq '"errcode"[[:space:]]*:[[:space:]]*30001' "$TMP_DIR/invalid-send.json"; then
    printf 'SEND_VALIDATION FAIL\n'
    exit 1
fi
printf 'SEND_VALIDATION PASS\n'

printf 'VULN03_ENDPOINT_REGRESSION PASS\n'