#!/usr/bin/env bash
# SPDX-FileCopyrightText: 2026 Echolot contributors
# SPDX-License-Identifier: GPL-3.0-or-later
#
# Runs core-protocol's LiveServerTest against the deployed fmr server: mints an
# enrollment token over SSH (admin is localhost-only), enrolls over the public
# control plane, computes the SPKI pin from the served cert, and hands the
# whole lot to the Gradle test. Proves the Kotlin client talks to the real
# server over the wire.
#
# Usage: JAVA_HOME=... echolot-app/scripts/test-fmr.sh
set -euo pipefail

SSH_HOST="${ECHOLOT_SSH:-claude-echolot}"
CTL_HOST="${ECHOLOT_CTL_HOST:-fmr-1.echo-lot.app}"
CTL_PORT="${ECHOLOT_CTL_PORT:-8443}"
UDP_PORT="${ECHOLOT_UDP_PORT:-8442}"
CTL_URL="https://${CTL_HOST}:${CTL_PORT}"

echo "· minting enrollment token on ${SSH_HOST} ..."
TOKEN=$(ssh -o BatchMode=yes "$SSH_HOST" \
  'curl -s -X POST http://127.0.0.1:8444/admin/enroll-tokens' \
  | python -c 'import json,sys;print(json.load(sys.stdin)["token"])')

echo "· enrolling over ${CTL_URL} ..."
CRED=$(curl -sk -X POST "${CTL_URL}/v1/enroll" -H "Authorization: Bearer ${TOKEN}" \
  | python -c 'import json,sys;print(json.load(sys.stdin)["credential"])')

echo "· computing SPKI pin from served cert ..."
PIN=$(echo | openssl s_client -connect "${CTL_HOST}:${CTL_PORT}" 2>/dev/null \
  | openssl x509 -pubkey -noout \
  | openssl pkey -pubin -outform der 2>/dev/null \
  | openssl dgst -sha256 -binary | openssl base64)

echo "· pin=${PIN}"
echo "· running LiveServerTest ..."
cd "$(dirname "$0")/.."
ECHOLOT_LIVE_URL="$CTL_URL" \
ECHOLOT_LIVE_PIN="$PIN" \
ECHOLOT_LIVE_CRED="$CRED" \
ECHOLOT_LIVE_UDP="${CTL_HOST}:${UDP_PORT}" \
ECHOLOT_LIVE_TARGET="${ECHOLOT_LIVE_TARGET:-fmr}" \
  ./gradlew :core-protocol:test --tests '*LiveServerTest*' --info --rerun-tasks --console=plain \
  2>&1 | grep -E "profile:|session:|echo |mtu probe|observations bytes|LiveServerTest|BUILD|FAIL|PASS" || true