#!/usr/bin/env bash
#
# run_test_two_pool_lifecycle.sh
#
# Wrapper for test_two_pool_lifecycle.py. Hardcodes the public pool B
# identifiers and AWS region the Go subprocess needs, sources the
# repo-root .env for secrets, and execs the Python test.
#
# Required in .env (or your shell):
#   PERMIT_IO_API_KEY    Permit.io project/env API key (secret).
#                        See .env.example.
#
# Optional (defaults shown):
#   AWS_PROFILE              AWS SSO profile with cognito-idp Admin*
#                            rights on us-east-2_Qom1i9qIG.
#                            Default: aarete.
#   SVC_LIFECYCLE_USERNAME   Throwaway username for the test cycle.
#                            Default: svc-lifecycle-test-1.
#
# Required AWS login state:
#   AWS_PROFILE must have an active session. Run
#     aws sso login --profile "$AWS_PROFILE"
#   first if the cached credentials have expired.
#
# Usage:
#   bash scripts/manual_tests/run_test_two_pool_lifecycle.sh

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

# Source repo-root .env so PERMIT_IO_API_KEY (and any AWS_PROFILE
# override) reach the shell before the fail-fast check below. Without
# this the operator would have to export the key in every shell, or
# Python would crash partway through the test.
if [ -f "$REPO_ROOT/.env" ]; then
    set -a
    # shellcheck disable=SC1090
    source "$REPO_ROOT/.env"
    set +a
fi

# Strip LocalStack endpoint overrides that the repo-root .env carries
# for the rest of the stack. aws-sdk-go-v2 treats AWS_ENDPOINT_URL as
# a global service-endpoint override — when it points at LocalStack
# (http://localhost:4566), every Cognito Admin* call returns HTTP 501
# because cognito-idp is a paid LocalStack feature.
unset AWS_ENDPOINT_URL AWS_ENDPOINT_URL_COGNITO_IDP

# Public, non-secret pool B identifiers. The Go subprocess (run.tool.sh)
# reads these from the environment, so we export them here.
export AWS_REGION="us-east-2"
export COGNITO_SVC_USER_POOL_ID="us-east-2_Qom1i9qIG"
export COGNITO_SVC_APP_CLIENT_ID="6r7chkvjotgs2bsfbd5ibaaft7"
export PERMIT_IO_BASE_URL="https://api.permit.io"

# Operator-specific. Honor an existing AWS_PROFILE in the env, fall
# back to "aarete" when unset.
export AWS_PROFILE="${AWS_PROFILE:-aarete}"

# Fail fast with a clear message rather than letting Python start,
# call AdminCreateUser, and crash on the Permit step with a vague
# 401 — which would leave the throwaway user dangling in Cognito.
: "${PERMIT_IO_API_KEY:?set PERMIT_IO_API_KEY in .env (preferred) or your shell before running}"

exec python3 "$REPO_ROOT/scripts/manual_tests/test_two_pool_lifecycle.py"