# Build and start
make docker-prod && make compose-down && make testing-up

# Key settings in .env:
AUTH_REQUIRED=true
MCPGATEWAY_ADMIN_API_ENABLED=true
# NOTE: There is NO RBAC_ENABLED setting

# Create tokens (use --teams flag, NOT --team-id)
export JWT_SECRET_KEY="${JWT_SECRET_KEY:-test-secret-32-chars-minimum!!}"
export ADMIN_TOKEN=$(python -m mcpgateway.utils.create_jwt_token \
  --username admin@example.com --exp 10080 --secret "$JWT_SECRET_KEY" --admin)
export TOKEN=$(python -m mcpgateway.utils.create_jwt_token \
  --username user@example.com --teams team-alpha --exp 10080 --secret "$JWT_SECRET_KEY")

# Use /tools for JSON API (NOT /admin/tools which expects form data)
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"test-tool","description":"Test","created_by":"attacker@evil.com","visibility":"public"}' \
  http://localhost:4444/tools | jq .

# Verify created_by was NOT set to attacker value (set server-side)

# NOTE: is_admin IS in EmailRegistrationRequest schema (schemas.py:5204)
# But only admins should be able to set is_admin=true

# Step 1: Non-admin tries to create admin user
curl -s -w "\nStatus: %{http_code}\n" \
  -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"newuser@example.com","password":"SecurePass123!","is_admin":true}' \
  http://localhost:4444/auth/email/admin/users

# Step 2: Admin creates admin user
curl -s -X POST -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email":"newadmin@example.com","password":"SecurePass123!","is_admin":true}' \
  http://localhost:4444/auth/email/admin/users | jq .

# User A (Team Alpha) - use --teams flag, NOT --team-id
TOKEN_A=$(python -m mcpgateway.utils.create_jwt_token \
  --username usera@example.com --teams alpha --exp 60 --secret "$JWT_SECRET_KEY")

# User B (Team Beta)
TOKEN_B=$(python -m mcpgateway.utils.create_jwt_token \
  --username userb@example.com --teams beta --exp 60 --secret "$JWT_SECRET_KEY")

# Create tool with User A
TOOL_ID=$(curl -s -X POST -H "Authorization: Bearer $TOKEN_A" \
  -H "Content-Type: application/json" \
  -d '{"name":"team-tool","visibility":"team"}' \
  http://localhost:4444/tools | jq -r '.id')

# Try to access with User B - should fail or return empty
curl -s -w "\nStatus: %{http_code}\n" \
  -H "Authorization: Bearer $TOKEN_B" \
  http://localhost:4444/tools/$TOOL_ID

# Step 1: User B tries to update User A's resource
curl -s -w "\nStatus: %{http_code}\n" \
  -X PUT -H "Authorization: Bearer $TOKEN_B" \
  -H "Content-Type: application/json" \
  -d '{"name":"Hacked Resource"}' \
  http://localhost:4444/tools/$USER_A_TOOL_ID

# Step 2: User B tries to delete User A's resource
curl -s -w "\nStatus: %{http_code}\n" \
  -X DELETE -H "Authorization: Bearer $TOKEN_B" \
  http://localhost:4444/tools/$USER_A_TOOL_ID

# Starlette uses LAST value for duplicate params (NOT first)
curl -s -H "Authorization: Bearer $TOKEN" \
  "http://localhost:4444/tools?limit=10&limit=100" | jq 'length'
# Result will use limit=100 (LAST value)

# Conflicting query and body params
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Body Name"}' \
  "http://localhost:4444/tools?name=Query+Name" | jq .name

# Get user by EMAIL (not ID) - correct endpoint path
curl -s -H "Authorization: Bearer $ADMIN_TOKEN" \
  http://localhost:4444/auth/email/admin/users/testuser@example.com | jq .

# /admin/tools expects FORM data, not JSON
curl -s -X POST -H "Authorization: Bearer $ADMIN_TOKEN" \
  -F "name=form-tool" \
  -F "description=Created via form" \
  http://localhost:4444/admin/tools

# JSON API is at /tools
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"json-tool","description":"Created via JSON"}' \
  http://localhost:4444/tools | jq .

# Form UPDATE routes have /edit suffix
# /admin/tools/{id} is GET (view JSON)
# /admin/tools/{id}/edit is POST (form update)

# Get tool as JSON (GET)
curl -s -H "Authorization: Bearer $ADMIN_TOKEN" \
  http://localhost:4444/admin/tools/$TOOL_ID | jq .

# Update tool via form (POST to /edit)
curl -s -X POST -H "Authorization: Bearer $ADMIN_TOKEN" \
  -F "name=updated-tool" \
  http://localhost:4444/admin/tools/$TOOL_ID/edit

# Same pattern for resources
curl -s -X POST -H "Authorization: Bearer $ADMIN_TOKEN" \
  -F "name=updated-resource" \
  http://localhost:4444/admin/resources/$RESOURCE_ID/edit

# Step 1: Valid request
curl -s -w "\nStatus: %{http_code}\n" \
  -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Valid Tool"}' \
  http://localhost:4444/tools

# Step 2: Invalid request (wrong type)
curl -s -w "\nStatus: %{http_code}\n" \
  -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":123}' \
  http://localhost:4444/tools

# Request with extra fields
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Tool","extra_field":"value","unknown":"data"}' \
  http://localhost:4444/tools | jq '{name, extra_field, unknown}'

# Create tool with team_id in schema
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"team-tool","team_id":"my-team","visibility":"team"}' \
  http://localhost:4444/tools | jq '{name, team_id}'

# Note: Services fall back to schema team_id when endpoint doesn't provide one
# See: tool_service.py:1043-1044, resource_service.py:458