#!/usr/bin/env bash
set -euo pipefail

BASE_URL="${BASE_URL:-https://wx.sstbc.com}"
COURSE_ID="${COURSE_ID:-}"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

request() {
    local name="$1"
    local url="$2"
    local body="$TMP_DIR/$name.json"
    local status

    status="$(curl -sS --max-time 20 -o "$body" -w '%{http_code}' "$url")"
    printf '%-28s HTTP %s\n' "$name" "$status"
    printf '%s\n' "$body"
}

request course-list "$BASE_URL/api/mobile/course/course?page=1&page_size=1"
request course-list-page-size-51 "$BASE_URL/api/mobile/course/course?page=1&page_size=51"
request course-detail-invalid "$BASE_URL/api/mobile/course/course-detail?course_id=not-an-id"
request course-detail-missing "$BASE_URL/api/mobile/course/course-detail?course_id=2147483647"

scan_sensitive_keys() {
    local name="$1"
    local body="$TMP_DIR/$name.json"
    local forbidden

    forbidden="$(jq -r '.. | objects | keys[]' "$body" | sort -u | rg -i '^(mobile|idcard|id_card|identity_card|remark|admin_id|department_id|teacher_id|deleted_at|password|remember_token)$' || true)"
    if [[ -n "$forbidden" ]]; then
        printf '%s FORBIDDEN_KEYS\n%s\n' "$name" "$forbidden"
        exit 1
    fi
    printf '%s SENSITIVE_SCAN PASS\n' "$name"
}

list_body="$TMP_DIR/course-list.json"
if jq -e '.data and (.data | type == "array")' "$list_body" >/dev/null; then
    scan_sensitive_keys course-list
    if [[ -z "$COURSE_ID" ]]; then
        COURSE_ID="$(jq -r '.data[0].id // empty' "$list_body")"
    fi

    if [[ -n "$COURSE_ID" ]]; then
        request course-detail-valid "$BASE_URL/api/mobile/course/course-detail?course_id=$COURSE_ID"
        request course-detail-pc-valid "$BASE_URL/api/mobile/course/course-detail-pc?course_id=$COURSE_ID"
        scan_sensitive_keys course-detail-valid
        scan_sensitive_keys course-detail-pc-valid
        jq -e '.id and .name' "$TMP_DIR/course-detail-valid.json" >/dev/null
        jq -e '.id and .name' "$TMP_DIR/course-detail-pc-valid.json" >/dev/null
        printf 'DETAIL_CORE_FIELDS PASS\n'
    else
        printf 'DETAIL_SCAN SKIP: course list is empty\n'
    fi
else
    printf 'SENSITIVE_SCAN SKIP: course list did not return a data array\n'
fi

if jq -e '.errcode == 10001' "$TMP_DIR/course-list-page-size-51.json" >/dev/null; then
    printf 'PAGE_SIZE_VALIDATION PASS\n'
else
    printf 'PAGE_SIZE_VALIDATION FAIL\n'
    exit 1
fi

if [[ "$(jq -r 'type' "$TMP_DIR/course-detail-invalid.json")" == "object" ]] && jq -e '.errcode == 10001' "$TMP_DIR/course-detail-invalid.json" >/dev/null; then
    printf 'COURSE_ID_VALIDATION PASS\n'
else
    printf 'COURSE_ID_VALIDATION FAIL\n'
    exit 1
fi

if [[ "$(jq -r 'type' "$TMP_DIR/course-detail-missing.json")" == "object" ]] && jq -e 'has("message") and .message == "课程不存在"' "$TMP_DIR/course-detail-missing.json" >/dev/null; then
    printf 'MISSING_COURSE_VALIDATION PASS\n'
else
    printf 'MISSING_COURSE_VALIDATION FAIL\n'
    exit 1
fi