#!/usr/bin/env bash

set -euo pipefail
# Uncomment the next line for debugging
#set -x

# A Bash script to test endpoints using a JWT token with owner privileges.
# All operations are performed on the namespace associated with the agent.

# This script:
#   1. Extracts the namespace ID and namespace short ID from the JWT token.
#   2. Performs the following actions within that namespace:
#       - Uploads media.
#       - Edits and deletes the media.
#       - Creates a temporary agent JWT.
#       - Deletes the temporary agent using the agent_id from the agent JWT.
#   3. Does not invite a user.
#   4. Does not require any changes to the application.

# Usage:
#   JWT_TOKEN=your_owner_jwt_token ./test_jwt_owner_agent.sh /path/to/mediafile.jpg

# Prerequisites:
#   - Replace 'your_owner_jwt_token' with a valid JWT token with 'owner' role.
#   - `curl` and `python` must be installed.
#   - Adjust BASE_URL as needed.

# Variables
BASE_URL="${BASE_URL:-http://localhost:6544}"
JWT_TOKEN="${JWT_TOKEN:-}"
MEDIA_FILE="${1:-}"

if [[ -z "$MEDIA_FILE" ]]; then
  echo "Usage: JWT_TOKEN=your_owner_jwt_token $0 /path/to/mediafile.jpg"
  exit 1
fi

if [[ -z "$JWT_TOKEN" ]]; then
  echo "Error: JWT_TOKEN environment variable is not set."
  exit 1
fi

# Function to URL-safe base64 decode
urlsafe_base64_decode() {
    local input="$1"
    local remainder=$(( ${#input} % 4 ))
    if [ $remainder -eq 2 ]; then
        input="${input}=="
    elif [ $remainder -eq 3 ]; then
        input="${input}="
    elif [ $remainder -eq 1 ]; then
        input="${input}="
    fi
    input=$(echo "$input" | tr '_-' '/+')
    echo "$input" | base64 --decode 2>/dev/null || {
        echo "Error: Failed to decode base64 input."
        exit 1
    }
}

echo "Extracting namespace IDs from JWT token..."

# Extract the payload from the JWT
PAYLOAD_BASE64=$(echo "$JWT_TOKEN" | cut -d "." -f2)
if [[ -z "$PAYLOAD_BASE64" ]]; then
  echo "Failed to extract payload from JWT token. Exiting."
  exit 1
fi

# Decode the payload
PAYLOAD_JSON=$(urlsafe_base64_decode "$PAYLOAD_BASE64")
if [[ -z "$PAYLOAD_JSON" ]]; then
  echo "Failed to decode JWT payload. Exiting."
  exit 1
fi

# Use python to parse JSON and extract the necessary fields
NAMESPACE_ID=$(python -c "import sys, json; print(json.loads(sys.stdin.read()).get('namespace_id', ''))" <<< "$PAYLOAD_JSON")
NAMESPACE_SHORT_ID=$(python -c "import sys, json; print(json.loads(sys.stdin.read()).get('namespace_short_id', ''))" <<< "$PAYLOAD_JSON")

if [[ -z "$NAMESPACE_ID" ]]; then
  echo "Namespace ID not found in JWT token. Exiting."
  exit 1
fi

if [[ -z "$NAMESPACE_SHORT_ID" ]]; then
  echo "Namespace Short ID not found in JWT token. Exiting."
  exit 1
fi

echo "Namespace ID: $NAMESPACE_ID"
echo "Namespace Short ID: $NAMESPACE_SHORT_ID"

echo ""
echo "=== Uploading Media (POST /namespace/$NAMESPACE_SHORT_ID/media/upload) ==="
UPLOAD_RESPONSE=$(curl -s -i \
  -X POST \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -F "media_file=@${MEDIA_FILE}" \
  -F "title=SampleMediaByOwner" \
  -F "is_public=on" \
  "$BASE_URL/namespace/$NAMESPACE_SHORT_ID/media/upload")

echo "$UPLOAD_RESPONSE"

echo ""
echo "Parsing 'Location' header to get the media short ID..."
MEDIA_SHORT_ID=$(echo "$UPLOAD_RESPONSE" | grep -Fi Location | tail -n 1 | awk -F '/' '{print $(NF-1)}' | tr -d '\r\n')
if [[ -z "$MEDIA_SHORT_ID" ]]; then
  echo "Failed to obtain media short ID. Exiting."
  exit 1
fi
echo "Media Short ID: $MEDIA_SHORT_ID"

echo ""
echo "=== Editing Media (POST /namespace/$NAMESPACE_SHORT_ID/media/$MEDIA_SHORT_ID/edit) ==="
EDIT_RESPONSE=$(curl -s -i \
  -X POST \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -F "title=UpdatedByOwner" \
  "$BASE_URL/namespace/$NAMESPACE_SHORT_ID/media/$MEDIA_SHORT_ID/edit")

echo "$EDIT_RESPONSE"

if echo "$EDIT_RESPONSE" | grep -q "403 Forbidden"; then
  echo "Error: Failed to edit media. You may not have permission."
  exit 1
fi

echo "Media title updated."

echo ""
echo "=== Deleting Media (POST /namespace/$NAMESPACE_SHORT_ID/media/$MEDIA_SHORT_ID/delete) ==="
DELETE_RESPONSE=$(curl -s -i \
  -X POST \
  -H "Authorization: Bearer $JWT_TOKEN" \
  "$BASE_URL/namespace/$NAMESPACE_SHORT_ID/media/$MEDIA_SHORT_ID/delete")

echo "$DELETE_RESPONSE"

if echo "$DELETE_RESPONSE" | grep -q "403 Forbidden"; then
  echo "Error: Failed to delete media. You may not have permission."
  exit 1
fi

echo "Media deleted."

echo ""
echo "=== Generating Temporary Agent JWT (POST /namespace/$NAMESPACE_SHORT_ID/generate_agent_jwt) ==="
AGENT_NAME="TempAgent$(date +%s)"
GENERATE_JWT_RESPONSE=$(curl -s \
  -X POST \
  -H "Authorization: Bearer $JWT_TOKEN" \
  -F "agent_name=$AGENT_NAME" \
  -F "agent_role=editor" \
  "$BASE_URL/namespace/$NAMESPACE_SHORT_ID/generate_agent_jwt")

# Extract the agent JWT token from the HTML response
AGENT_JWT=$(echo "$GENERATE_JWT_RESPONSE" | grep -oP '(?<=<pre>)[^<]*(?=</pre>)')

if [[ -z "$AGENT_JWT" ]]; then
  echo "Failed to extract agent JWT token from response."
  exit 1
fi

echo "Temporary agent '$AGENT_NAME' has been created."

echo ""
echo "Extracting agent ID from agent JWT token..."

# Extract the payload from the agent JWT
AGENT_PAYLOAD_BASE64=$(echo "$AGENT_JWT" | cut -d "." -f2)
if [[ -z "$AGENT_PAYLOAD_BASE64" ]]; then
  echo "Failed to extract payload from agent JWT token. Exiting."
  exit 1
fi

# Decode the payload
AGENT_PAYLOAD_JSON=$(urlsafe_base64_decode "$AGENT_PAYLOAD_BASE64")
if [[ -z "$AGENT_PAYLOAD_JSON" ]]; then
  echo "Failed to decode agent JWT payload. Exiting."
  exit 1
fi

# Extract the agent_id from the payload
AGENT_ID=$(python -c "import sys, json; print(json.loads(sys.stdin.read()).get('agent_id', ''))" <<< "$AGENT_PAYLOAD_JSON")

if [[ -z "$AGENT_ID" ]]; then
  echo "Failed to extract agent_id from agent JWT payload. Exiting."
  exit 1
fi

echo "Agent ID: $AGENT_ID"

echo ""
echo "=== Deleting Temporary Agent '$AGENT_NAME' ==="

# Delete the temporary agent
DELETE_AGENT_RESPONSE=$(curl -s -i \
  -X POST \
  -H "Authorization: Bearer $JWT_TOKEN" \
  "$BASE_URL/namespace/$NAMESPACE_SHORT_ID/agents/$AGENT_ID/delete")

echo "$DELETE_AGENT_RESPONSE"

if echo "$DELETE_AGENT_RESPONSE" | grep -q "403 Forbidden"; then
  echo "Error: Failed to delete temporary agent '$AGENT_NAME'. You may not have permission."
  exit 1
fi

echo "Temporary agent '$AGENT_NAME' has been deleted."

echo ""
echo "Test complete. All actions performed successfully using a JWT token with owner privileges on the specified namespace."