#!/usr/bin/env bash
# test_two_pool_auth.sh runs the end-to-end integration test for the
# two-pool service-account auth path against a running queryAPI.
#
# The script assumes the target environment is already provisioned:
#  - The test service account exists in the Cognito service pool
#    (us-east-2_Qom1i9qIG).
#  - It is already registered in the Permit instance backing the
#    target queryAPI with the super_admin role. This script does NOT
#    touch Permit — that is an environment-setup concern.
#  - SVC_TEST_PASSWORD is available (in env or any .env walked up
#    from this file to the filesystem root).
#
# Usage:
#   ./scripts/manual_tests/test_two_pool_auth.sh
#   BASE_URL=http://localhost:8080 ./scripts/manual_tests/test_two_pool_auth.sh
#   INSECURE_TLS=0 ./scripts/manual_tests/test_two_pool_auth.sh   # require valid cert

set -euo pipefail

# ---------------------------------------------------------------------------
# Target queryAPI to test against. Uncomment ONE line below.
# Override at the CLI with: BASE_URL=https://... ./test_two_pool_auth.sh
# ---------------------------------------------------------------------------
: "${BASE_URL:=https://queryo-query-q0pz6j2syaox-1001614225.us-east-2.elb.amazonaws.com}"
# : "${BASE_URL:=http://localhost:8080}"
# ---------------------------------------------------------------------------

# The default BASE_URL above is an ALB with a self-signed cert. Python's
# urllib rejects that by default, so opt into the bypass here. Unset or
# set to 0 if you point BASE_URL at a host with a real CA-issued cert.
: "${INSECURE_TLS:=1}"
export INSECURE_TLS

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

echo "Step 1/2: confirm queryAPI is running with pool B enabled."
echo "  - COGNITO_USER_POOL_ID     should be set (existing pool A)"
echo "  - COGNITO_SVC_USER_POOL_ID should be us-east-2_Qom1i9qIG (pool B)"
echo "  - DISABLE_AUTH             must be unset (we are testing real auth)"
echo "  - queryAPI must be reachable at ${BASE_URL}"
echo
read -rp "Press enter when queryAPI is up and configured..."

echo
echo "Step 2/2: running test_two_pool_auth.py against ${BASE_URL}..."
python3 "$REPO_ROOT/scripts/manual_tests/test_two_pool_auth.py" --base-url "${BASE_URL}"