#!/usr/bin/env bash
# Verify the enrol-broker as deployed in the serving stack. Run ON THE SERVING
# HOST. Exercises the FULL path: public side through the nginx /enrol/ proxy
# (:80) + the admin plane on loopback :9443.
#
#   ./verify-serving.sh                       # admin insecure (ENROL_ADMIN_INSECURE=true)
#   ADMIN_P12=enrol-pki/broker/clients/alice.p12 ./verify-serving.sh   # admin mTLS
#
# Stand-in for the (not-yet-built) host side: an openssl CSR plays the TPM key.
set -euo pipefail

PUB_BASE="${PUB_BASE:-http://127.0.0.1/enrol}"   # via nginx; use http://127.0.0.1:9090 to hit broker directly
ADMIN_BASE="${ADMIN_BASE:-http://127.0.0.1:9443}"
ADMIN_P12="${ADMIN_P12:-}"                        # set => admin is mTLS (https + client cert)

WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
jqget() { python3 -c 'import json,sys;print(json.load(sys.stdin)["'"$1"'"])'; }

# admin curl: plaintext by default, or mTLS if a .p12 is given.
admin() {
  if [ -n "$ADMIN_P12" ]; then
    openssl pkcs12 -in "$ADMIN_P12" -clcerts -nokeys -passin pass: -out "$WORK/ac.pem" 2>/dev/null
    openssl pkcs12 -in "$ADMIN_P12" -nocerts -nodes -passin pass: -out "$WORK/ak.pem" 2>/dev/null
    curl -fsS --cert "$WORK/ac.pem" --key "$WORK/ak.pem" -k "${ADMIN_BASE/http:/https:}$1" "${@:2}"
  else
    curl -fsS "$ADMIN_BASE$1" "${@:2}"
  fi
}

echo "== healthz (through nginx) =="
curl -fsS "$PUB_BASE/healthz"; echo

echo "== generate CSR (stand-in for the TPM key) =="
openssl ecparam -name prime256v1 -genkey -noout -out "$WORK/h.key" 2>/dev/null
openssl req -new -key "$WORK/h.key" -subj "/CN=fleet-host" -out "$WORK/h.csr" 2>/dev/null
CSR_JSON=$(python3 -c 'import json,sys;print(json.dumps(open(sys.argv[1]).read()))' "$WORK/h.csr")

echo "== POST /enrol/request =="
REQ=$(curl -fsS -X POST "$PUB_BASE/request" -H 'Content-Type: application/json' \
  -d "{\"csr\": $CSR_JSON, \"context\": {\"mac\":\"de:ad:be:ef:00:01\",\"dmi_serial\":\"VERIFY-001\"}}")
echo "$REQ"
ID=$(echo "$REQ" | jqget enrol_id)
echo "enrol_id=$ID  fingerprint=$(echo "$REQ" | jqget fingerprint)"

echo "== admin /pending =="; admin /pending; echo
echo "== approve $ID =="; admin "/approve/$ID" -X POST; echo
echo "== /enrol/status/$ID (expect approved + cert) =="
curl -fsS "$PUB_BASE/status/$ID" | python3 -m json.tool
echo
echo "PASS: request -> approve -> cert through the serving deployment."