#!/bin/bash
# Revolut Webhook Verification Suite
# Tests 6 & 7: Webhook Security Features

echo ""
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║     REVOLUT WEBHOOK VERIFICATION SUITE - GATE 3               ║"
echo "║     Date: $(date '+%Y-%m-%d %H:%M:%S %Z')                             ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""

# Detect environment
if [ -f "/home/globalgalashow/public_html/dev/artisan" ]; then
    BASE_URL="https://dev.globalgalashow.com"
    echo "Environment: STAGING SERVER"
else
    BASE_URL="http://localhost:8000"
    echo "Environment: LOCAL"
fi

echo "Base URL: $BASE_URL"
echo ""

RESULTS=()

# ============================================================================
# TEST 6: WEBHOOK SIGNATURE VERIFICATION (P1)
# ============================================================================
echo "┌────────────────────────────────────────────────────────────────┐"
echo "│ TEST 6: Webhook Signature Verification (P1)                   │"
echo "└────────────────────────────────────────────────────────────────┘"
echo ""

echo "  Testing: Invalid webhook signature rejection..."
echo ""

RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}" -X POST "$BASE_URL/api/webhooks/revolut" \
  -H "Content-Type: application/json" \
  -H "Revolut-Signature: v1=invalid_signature,t=$(date +%s)" \
  -d '{
    "event": "ORDER_COMPLETED",
    "order_id": "test_order_123",
    "timestamp": '$(date +%s000)'
  }')

HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP_CODE" | cut -d: -f2)
BODY=$(echo "$RESPONSE" | sed '/HTTP_CODE/d')

echo "  Response Code: $HTTP_CODE"
echo "  Response Body: $BODY"
echo ""

if [ "$HTTP_CODE" = "401" ]; then
    if echo "$BODY" | grep -q "Invalid signature"; then
        echo "  Result: ✅ PASS - Invalid signature rejected with 401"
        RESULTS+=("TEST-6:PASS")
    else
        echo "  Result: ❌ FAIL - 401 returned but wrong error message"
        RESULTS+=("TEST-6:FAIL")
    fi
else
    echo "  Result: ❌ FAIL - Expected 401, got $HTTP_CODE"
    RESULTS+=("TEST-6:FAIL")
fi

echo ""

# ============================================================================
# TEST 7: REPLAY ATTACK PREVENTION (P1)
# ============================================================================
echo "┌────────────────────────────────────────────────────────────────┐"
echo "│ TEST 7: Replay Attack Prevention (P1)                         │"
echo "└────────────────────────────────────────────────────────────────┘"
echo ""

echo "  Testing: Old timestamp rejection (replay attack prevention)..."
echo ""

# Create timestamp from 10 minutes ago (600 seconds)
OLD_TIMESTAMP=$(($(date +%s) - 600))

echo "  Current time: $(date +%s)"
echo "  Old timestamp: $OLD_TIMESTAMP (10 minutes ago)"
echo "  Tolerance: 300 seconds (5 minutes)"
echo ""

RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}" -X POST "$BASE_URL/api/webhooks/revolut" \
  -H "Content-Type: application/json" \
  -H "Revolut-Signature: v1=old_signature,t=$OLD_TIMESTAMP" \
  -d '{
    "event": "ORDER_COMPLETED",
    "order_id": "replay_test_123",
    "timestamp": '$(($OLD_TIMESTAMP * 1000))'
  }')

HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP_CODE" | cut -d: -f2)
BODY=$(echo "$RESPONSE" | sed '/HTTP_CODE/d')

echo "  Response Code: $HTTP_CODE"
echo "  Response Body: $BODY"
echo ""

if [ "$HTTP_CODE" = "401" ]; then
    if echo "$BODY" | grep -q "timestamp"; then
        echo "  Result: ✅ PASS - Old timestamp rejected (replay attack prevented)"
        RESULTS+=("TEST-7:PASS")
    else
        echo "  Result: ⚠️ PARTIAL - 401 returned but may be signature error, not timestamp"
        echo "  Note: Check Laravel logs for 'timestamp outside tolerance' message"
        RESULTS+=("TEST-7:PARTIAL")
    fi
else
    echo "  Result: ❌ FAIL - Expected 401, got $HTTP_CODE"
    RESULTS+=("TEST-7:FAIL")
fi

echo ""

# ============================================================================
# SUMMARY
# ============================================================================
echo "╔════════════════════════════════════════════════════════════════╗"
echo "║                 WEBHOOK TEST RESULTS SUMMARY                   ║"
echo "╚════════════════════════════════════════════════════════════════╝"
echo ""

PASSED=0
FAILED=0
PARTIAL=0

for result in "${RESULTS[@]}"; do
    TEST=$(echo "$result" | cut -d: -f1)
    STATUS=$(echo "$result" | cut -d: -f2)

    case "$STATUS" in
        PASS)
            echo "  ✅ $TEST: PASS"
            PASSED=$((PASSED + 1))
            ;;
        FAIL)
            echo "  ❌ $TEST: FAIL"
            FAILED=$((FAILED + 1))
            ;;
        PARTIAL)
            echo "  ⚠️ $TEST: PARTIAL"
            PARTIAL=$((PARTIAL + 1))
            ;;
    esac
done

echo ""
echo "  Total Tests: ${#RESULTS[@]}"
echo "  Passed: $PASSED"
echo "  Partial: $PARTIAL"
echo "  Failed: $FAILED"
echo ""

if [ $FAILED -gt 0 ]; then
    echo "╔════════════════════════════════════════════════════════════════╗"
    echo "║                    ❌ VERIFICATION FAILED                      ║"
    echo "╚════════════════════════════════════════════════════════════════╝"
    exit 1
else
    echo "╔════════════════════════════════════════════════════════════════╗"
    echo "║              ✅ VERIFICATION SUCCESSFUL                        ║"
    echo "╚════════════════════════════════════════════════════════════════╝"
    exit 0
fi