#!/bin/bash
# fe_comment API-Testkette (braucht eingeloggte Session aus fec_login_test.sh)
# Aufruf: bash migrations/fec_api_test.sh
set -e
cd /usr/www/users/vitecevo/live
BASE=https://dev.vitec.com
JAR=/tmp/fec.jar
[ -s "$JAR" ] || { echo "Cookie-Jar fehlt - erst migrations/fec_login_test.sh laufen lassen."; exit 1; }

echo '--- 1) Feedback anlegen (mit Sanitizer-Probe: script-Tag muss verschwinden, strong bleiben) ---'
curl -sS -b "$JAR" -H 'Content-Type: application/json' \
    -d '{"url":"https://dev.vitec.com/testseite","note":"<p>Erster Test <script>alert(1)</script> mit <strong>fett</strong></p>"}' \
    "$BASE/api/fe-comment/feedback" | tee /tmp/fec_fb.json; echo

FB=$(php -r '$j=json_decode(file_get_contents("/tmp/fec_fb.json"),true);echo (int)($j["uid"]??0);')
echo "Feedback-UID: $FB"
[ "$FB" -gt 0 ] || { echo "Anlegen fehlgeschlagen."; exit 1; }

echo '--- 2) Feedback aendern ---'
curl -sS -b "$JAR" -H 'Content-Type: application/json' \
    -d '{"note":"<p>Geaenderte Notiz, <em>kursiv</em>.</p>"}' \
    "$BASE/api/fe-comment/feedback/$FB"; echo

echo '--- 3) Datei-Upload (Test-PNG vom Server) ---'
curl -sS -b "$JAR" \
    -F "file=@public/testimages/placeholder_1920x600.png;type=image/png" \
    -F "feedback=$FB" \
    "$BASE/api/fe-comment/upload"; echo

echo '--- 4) General Notes an der Summary ---'
curl -sS -b "$JAR" -H 'Content-Type: application/json' \
    -d '{"generalNotes":"<p>Bitte alles einmal durchsehen.</p>","recipients":[]}' \
    "$BASE/api/fe-comment/summary"; echo

echo '--- 5) Gesamtzustand ---'
curl -sS -b "$JAR" "$BASE/api/fe-comment/state"; echo

read -rp "6) Submit ausloesen (Mail an die mailTo-Adresse)? [j/N] " yn
if [[ "$yn" =~ ^[jJyY] ]]; then
    curl -sS -b "$JAR" -X POST "$BASE/api/fe-comment/submit"; echo
    echo '--- state nach Submit (Summary sollte weg/neu sein) ---'
    curl -sS -b "$JAR" "$BASE/api/fe-comment/state"; echo
fi