#!/usr/bin/env bash
# Lokale Test-Nextcloud fuer quick-261008-mzu (idempotent).
#   Container: tessera-nc-test (nextcloud:stable, SQLite), Host-Port 18080
#   Benutzer:  admin / Admin-Pass-12345
#              anna  / User1-Pass-12345  (ohne Zwei-Faktor, "Anna Müller")
#              zoe   / User2-Pass-12345  (Zwei-Faktor TOTP erzwungen, "Zwei Faktor")
#   TOTP-Geheimnis von zoe im Container: /var/www/zoe-totp-secret
#     Code: python3 -I totp.py "$(docker exec tessera-nc-test cat /var/www/zoe-totp-secret)"
# Nur Testwerte, nie fuer echte Systeme verwenden. Liest keine .env-Dateien.
set -euo pipefail

NAME=tessera-nc-test
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT="$(cd "$HERE/../../../.." && pwd)"
occ() { docker exec -u www-data "$NAME" php occ "$@"; }

if ! docker inspect "$NAME" >/dev/null 2>&1; then
  docker run -d --name "$NAME" -p 18080:80 \
    -e SQLITE_DATABASE=nextcloud \
    -e NEXTCLOUD_ADMIN_USER=admin \
    -e NEXTCLOUD_ADMIN_PASSWORD='Admin-Pass-12345' \
    -e NEXTCLOUD_TRUSTED_DOMAINS='localhost 127.0.0.1 172.17.0.1 tessera-nc-test' \
    nextcloud:stable >/dev/null
elif [ "$(docker inspect -f '{{.State.Running}}' "$NAME")" != "true" ]; then
  docker start "$NAME" >/dev/null
fi

for _ in $(seq 1 36); do
  if curl -s http://localhost:18080/status.php | grep -q '"installed":true'; then break; fi
  sleep 5
done
curl -s http://localhost:18080/status.php | grep -q '"installed":true' || { echo "nextcloud not installed in time" >&2; exit 1; }

if ! occ user:info anna >/dev/null 2>&1; then
  docker exec -u www-data -e OC_PASS='User1-Pass-12345' "$NAME" \
    php occ user:add --password-from-env --display-name="Anna Müller" anna
fi
if ! occ user:info zoe >/dev/null 2>&1; then
  docker exec -u www-data -e OC_PASS='User2-Pass-12345' "$NAME" \
    php occ user:add --password-from-env --display-name="Zwei Faktor" zoe
fi

if ! occ group:list 2>/dev/null | grep -q 'twofa'; then
  occ group:add twofa >/dev/null
fi
occ group:adduser twofa zoe >/dev/null 2>&1 || true
occ twofactorauth:enforce --on --group=twofa >/dev/null

if ! occ twofactorauth:state zoe 2>/dev/null | grep -q totp; then
  docker cp "$HERE/totp.php" "$NAME:/tmp/totp.php"
  SECRET="$(docker exec -u www-data "$NAME" php /tmp/totp.php zoe secret | tail -1)"
  docker exec -u www-data "$NAME" php /tmp/totp.php zoe "$(python3 -I "$HERE/totp.py" "$SECRET")" >/dev/null
  docker exec "$NAME" sh -c "printf '%s' '$SECRET' > /var/www/zoe-totp-secret"
fi

# Brute-Force-Sperre: gesamtes Docker-Adressband ausnehmen, damit wiederholte Testlaeufe
# die IP nie sperren. Das 429-Verhalten decken die Einheitstests ab.
occ config:app:set bruteForce whitelist_0 --value=172.16.0.0/12 >/dev/null

# Erreichbarkeit aus dem api-Container (Host-Gateway)
cd "$ROOT"
docker compose exec -T api node -e "fetch('http://172.17.0.1:18080/status.php').then(r=>process.exit(r.status===200?0:1)).catch(()=>process.exit(1))"

echo "nc test ready"