#!/usr/bin/env bash
# L2 端到端验证脚本
set -euo pipefail
# 管理员 user key。**不要把它写进这个文件**。
#
# 2026-09-12：本文件原来硬编码了一把 jianf 的 user key（自 1759666 起在 git 历史里）。
# 已轮换作废（旧值实测 /auth/me → 401），新值只存在 /root/gotmp/verify-l2-token.txt（600）。 —— 仓库是会被看到的地方，
# 而写进 git 历史的密钥只能靠轮换作废（删掉当前行不能把它从历史里拿掉）。
#
# 取法（任一）：
#   VERIFY_L2_TOKEN=<key> bash scripts/verify-l2.sh
#   echo <key> > /root/gotmp/verify-l2-token.txt && chmod 600 该文件
TOKEN="${VERIFY_L2_TOKEN:-}"
if [ -z "$TOKEN" ] && [ -r /root/gotmp/verify-l2-token.txt ]; then
  TOKEN=$(tr -d '\n' < /root/gotmp/verify-l2-token.txt)
fi
if [ -z "$TOKEN" ]; then
  echo "需要管理员 user key：设 VERIFY_L2_TOKEN，或写到 /root/gotmp/verify-l2-token.txt（600）" >&2
  exit 2
fi
BASE="http://127.0.0.1:8180/api/v1"
H=(-H "Authorization: Bearer $TOKEN")
PASS=0 FAIL=0

ok()  { echo "  ✅ $1"; PASS=$((PASS+1)); }
bad() { echo "  ❌ $1"; FAIL=$((FAIL+1)); }

echo "=== L2 端到端验证 ==="

# ── 1. PUT /sessions/:id/permission
SID=$(sqlite3 /opt/agentmail/data/agentmail.db "SELECT session_id FROM sessions ORDER BY updated_at DESC LIMIT 1;")
echo "1. PUT /sessions/:id/permission ($SID)"

# 改 plan
R=$(curl -s -X PUT "$BASE/sessions/$SID/permission" -H 'Content-Type: application/json' "${H[@]}" -d '{"permission_mode":"plan"}')
if echo "$R" | grep -q '"permission_mode":"plan"'; then ok "plan 写入成功"; else bad "plan 写入失败: $R"; fi

# 改 full
R=$(curl -s -X PUT "$BASE/sessions/$SID/permission" -H 'Content-Type: application/json' "${H[@]}" -d '{"permission_mode":"full"}')
if echo "$R" | grep -q '"permission_mode":"full"'; then ok "full 写入成功"; else bad "full 写入失败: $R"; fi

# 脏值 → 回落到 workspace
R=$(curl -s -X PUT "$BASE/sessions/$SID/permission" -H 'Content-Type: application/json' "${H[@]}" -d '{"permission_mode":"bogus"}')
if echo "$R" | grep -q '"permission_mode":"workspace"'; then ok "脏值回落到 workspace"; else bad "脏值未回落: $R"; fi

# 复原
curl -s -X PUT "$BASE/sessions/$SID/permission" -H 'Content-Type: application/json' "${H[@]}" -d '{"permission_mode":"workspace"}' > /dev/null

# ── 2. calendar_events.permission_mode 列
echo "2. calendar_events.permission_mode 列"
COL=$(sqlite3 /opt/agentmail/data/agentmail.db "PRAGMA table_info(calendar_events);" | grep permission_mode || true)
if [ -n "$COL" ]; then ok "列存在: $COL"; else bad "列不存在"; fi

# ── 3. 建会话检查 schema 两列
echo "3. sessions permission_mode/enforcement 列"
PM=$(sqlite3 /opt/agentmail/data/agentmail.db "PRAGMA table_info(sessions);" | grep permission_mode || true)
PE=$(sqlite3 /opt/agentmail/data/agentmail.db "PRAGMA table_info(sessions);" | grep permission_enforcement || true)
if [ -n "$PM" ]; then ok "permission_mode 列存在"; else bad "permission_mode 列缺失"; fi
if [ -n "$PE" ]; then ok "permission_enforcement 列存在"; else bad "permission_enforcement 列缺失"; fi

echo ""
echo "=== 结果: $PASS 通过, $FAIL 失败 ==="