# Build and start
make docker-prod && make compose-down && make testing-up

# Key settings in .env for encryption testing:
AUTH_REQUIRED=true
AUTH_ENCRYPTION_SECRET=your-32-char-encryption-secret!!

# Argon2id parameters (CORRECT env var names with "ID" suffix):
ARGON2ID_TIME_COST=3
ARGON2ID_MEMORY_COST=65536
ARGON2ID_PARALLELISM=1

# Password policy:
PASSWORD_POLICY_ENABLED=true
PASSWORD_MIN_LENGTH=8
PASSWORD_REQUIRE_UPPERCASE=true
PASSWORD_REQUIRE_LOWERCASE=true
PASSWORD_REQUIRE_DIGIT=true
PASSWORD_REQUIRE_SPECIAL=true

# Step 1: Create user with password (CORRECT endpoint)
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"test@example.com","password":"SecureP@ssw0rd!"}' \
  http://localhost:4444/auth/email/register | jq .

# Step 2: Check stored hash format in database
sqlite3 mcp.db "SELECT password_hash FROM email_users WHERE email='test@example.com';"
# Hash should start with $argon2id$v=19$

# Step 1: Configure custom parameters (CORRECT env var names)
export ARGON2ID_TIME_COST=4
export ARGON2ID_MEMORY_COST=131072
export ARGON2ID_PARALLELISM=2

# Step 2: Restart server and create user
# Hash should reflect new parameters: m=131072,t=4,p=2
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"test2@example.com","password":"SecureP@ssw0rd!"}' \
  http://localhost:4444/auth/email/register | jq .

# Step 3: Verify hash parameters
sqlite3 mcp.db "SELECT password_hash FROM email_users WHERE email='test2@example.com';"

# Step 1: Login with correct password (CORRECT endpoint)
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"test@example.com","password":"SecureP@ssw0rd!"}' \
  http://localhost:4444/auth/email/login | jq .

# Step 2: Login with wrong password
curl -s -w "\nStatus: %{http_code}\n" \
  -X POST -H "Content-Type: application/json" \
  -d '{"email":"test@example.com","password":"wrongpassword"}' \
  http://localhost:4444/auth/email/login

# Step 1: Time verification with correct password
for i in {1..10}; do
  time curl -s -X POST -H "Content-Type: application/json" \
    -d '{"email":"test@example.com","password":"SecureP@ssw0rd!"}' \
    http://localhost:4444/auth/email/login > /dev/null
done

# Step 2: Time verification with wrong password
for i in {1..10}; do
  time curl -s -X POST -H "Content-Type: application/json" \
    -d '{"email":"test@example.com","password":"wrongpassword"}' \
    http://localhost:4444/auth/email/login > /dev/null
done

# Step 3: Compare timing distributions

# Note: No /api/oauth/clients endpoint exists
# The encryption service IS used for:
# - Gateway credentials (services/gateway_service.py)
# - API tokens (services/token_service.py)

# To test encryption manually via Python:
python -c "
from mcpgateway.services.encryption_service import EncryptionService

# MUST provide encryption_secret (required constructor arg)
svc = EncryptionService('my-32-char-encryption-secret!!')

# Methods are encrypt_secret/decrypt_secret (NOT encrypt/decrypt)
encrypted = svc.encrypt_secret('my-secret-value')
print(f'Encrypted: {encrypted}')

# Verify it's a JSON bundle
import json
data = json.loads(encrypted)
print(f'KDF: {data[\"kdf\"]}')  # Should be 'argon2id'
print(f'Has salt: {\"salt\" in data}')
print(f'Has token: {\"token\" in data}')  # Fernet token starts with gAAAAA
"

# Test decryption via Python:
python -c "
from mcpgateway.services.encryption_service import EncryptionService

svc = EncryptionService('my-32-char-encryption-secret!!')

# Encrypt then decrypt
original = 'super-secret-value'
encrypted = svc.encrypt_secret(original)
decrypted = svc.decrypt_secret(encrypted)

print(f'Original: {original}')
print(f'Decrypted: {decrypted}')
print(f'Match: {original == decrypted}')
"

# Key derivation uses Argon2id (NOT PBKDF2 as originally claimed)
# See encryption_service.py:74-96 - derive_key_argon2id()

python -c "
from mcpgateway.services.encryption_service import EncryptionService

# Different secrets produce different keys
svc1 = EncryptionService('master-secret-key-32-chars-min!!')
svc2 = EncryptionService('different-secret-32-chars-min!!')

encrypted1 = svc1.encrypt_secret('test')
encrypted2 = svc2.encrypt_secret('test')

# Same secret can decrypt its own encrypted values
decrypted1 = svc1.decrypt_secret(encrypted1)
print(f'svc1 decrypts own: {decrypted1}')

# But cannot decrypt values from different secret
try:
    svc1.decrypt_secret(encrypted2)
    print('ERROR: Should have failed')
except Exception as e:
    print(f'Correctly failed: {type(e).__name__}')
"

# Detection supports BOTH formats (encryption_service.py:183):
# 1. New Argon2id JSON bundle: {"kdf":"argon2id",...}
# 2. Legacy PBKDF2 base64-wrapped Fernet format

python -c "
from mcpgateway.services.encryption_service import EncryptionService

svc = EncryptionService('my-32-char-encryption-secret!!')

# Test detection of JSON format
json_encrypted = svc.encrypt_secret('test')
print(f'JSON format detected: {svc.is_encrypted(json_encrypted)}')  # True

# Plain text not detected as encrypted
print(f'Plain text detected: {svc.is_encrypted(\"plain-text\")}')  # False

# Re-encryption prevention
encrypted_twice = svc.encrypt_secret(json_encrypted)
# Should detect and not double-encrypt (or handle gracefully)
"

# Step 1: Start with short secret (should warn)
export JWT_SECRET_KEY="short"
# Check logs for warning about minimum length

# Step 2: Start with weak/default secret (should warn)
export JWT_SECRET_KEY="changeme"
# Check logs for warning about weak secret

# Step 3: Start with low entropy secret (should warn)
export JWT_SECRET_KEY="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
# Check logs for warning about low entropy (< 10 unique chars)

# Step 4: Start with valid secret
export JWT_SECRET_KEY="this-is-a-strong-32-char-secret!"
# Should work without warning

# Step 1: Missing encryption secret
unset AUTH_ENCRYPTION_SECRET
# Check behavior (may use fallback or error)

# Step 2: Short encryption secret
export AUTH_ENCRYPTION_SECRET="short"
# Should warn

# Step 3: Valid encryption secret
export AUTH_ENCRYPTION_SECRET="valid-32-char-encryption-secret!"
# Should work without warning

# Validation happens in config.py:594-633

# Step 1: Try weak password
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"weak@example.com","password":"123456"}' \
  http://localhost:4444/auth/email/register

# Step 2: Try password without special chars
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"weak2@example.com","password":"Password123"}' \
  http://localhost:4444/auth/email/register

# Step 3: Try valid complex password
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"email":"strong@example.com","password":"SecureP@ssw0rd!"}' \
  http://localhost:4444/auth/email/register

# Create multiple users with same password
for i in 1 2 3; do
  curl -s -X POST -H "Content-Type: application/json" \
    -d "{\"email\":\"salt-test-$i@example.com\",\"password\":\"SamePassword123!\"}" \
    http://localhost:4444/auth/email/register > /dev/null
done

# Check that hashes are different
sqlite3 mcp.db "SELECT email, password_hash FROM email_users WHERE email LIKE 'salt-test%';"