#!/bin/bash

###############################################################################
# Security Features Test Suite
# Tests all security enhancements for translate-press-zone plugin
###############################################################################

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration
WEBHOOK_URL="${WEBHOOK_URL:-http://localhost:8000/wp-json/translate-press-zone/v1/callback}"
API_URL="${API_URL:-http://185.151.198.60:3000}"
TEST_RESULTS_FILE="./test-results.txt"

# Counters
TESTS_TOTAL=0
TESTS_PASSED=0
TESTS_FAILED=0

# Helper functions
print_header() {
    echo -e "\n${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${BLUE}  $1${NC}"
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}\n"
}

print_test() {
    echo -e "${YELLOW}TEST:${NC} $1"
    TESTS_TOTAL=$((TESTS_TOTAL + 1))
}

print_pass() {
    echo -e "${GREEN}✓ PASS:${NC} $1"
    TESTS_PASSED=$((TESTS_PASSED + 1))
}

print_fail() {
    echo -e "${RED}✗ FAIL:${NC} $1"
    TESTS_FAILED=$((TESTS_FAILED + 1))
}

print_info() {
    echo -e "${BLUE}ℹ INFO:${NC} $1"
}

# Test functions

test_rate_limiting() {
    print_header "Test 1: Rate Limiting (100 requests/hour/IP)"
    
    print_test "Sending 101 requests from same IP to webhook endpoint"
    
    local success_count=0
    local rate_limited_count=0
    
    for i in {1..101}; do
        response=$(curl -s -w "\n%{http_code}" -X POST "$WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -d '{"test": "rate_limit"}' 2>/dev/null)
        
        http_code=$(echo "$response" | tail -n1)
        
        if [ "$http_code" = "200" ] || [ "$http_code" = "400" ]; then
            success_count=$((success_count + 1))
        elif [ "$http_code" = "403" ] || [ "$http_code" = "429" ]; then
            rate_limited_count=$((rate_limited_count + 1))
        fi
        
        # Progress indicator
        if [ $((i % 10)) -eq 0 ]; then
            echo -n "."
        fi
    done
    echo ""
    
    print_info "Successful requests: $success_count"
    print_info "Rate limited requests: $rate_limited_count"
    
    if [ $rate_limited_count -gt 0 ]; then
        print_pass "Rate limiting is working (blocked $rate_limited_count requests)"
    else
        print_fail "Rate limiting not working (all requests succeeded)"
    fi
}

test_xss_prevention() {
    print_header "Test 2: XSS Prevention (Content Sanitization)"
    
    print_test "Attempting to inject script tags in translation content"
    
    local malicious_content="<p>Normal text</p><script>alert('XSS')</script><p>More text</p>"
    
    # This test requires WordPress context, so we'll create a test file
    php -r "
        define('ABSPATH', '$(pwd)/../../../../../../');
        require_once ABSPATH . 'wp-load.php';
        
        \$content = '$malicious_content';
        \$sanitized = wp_kses(\$content, [
            'p' => [], 'br' => [], 'strong' => [], 'em' => [], 'i' => [], 'b' => []
        ]);
        
        if (strpos(\$sanitized, '<script>') === false) {
            echo 'PASS: Script tags removed';
            exit(0);
        } else {
            echo 'FAIL: Script tags still present';
            exit(1);
        }
    " 2>/dev/null
    
    if [ $? -eq 0 ]; then
        print_pass "XSS prevention working (script tags removed)"
    else
        print_fail "XSS prevention not working (script tags present)"
    fi
}

test_ssrf_prevention() {
    print_header "Test 3: SSRF Prevention (API URL Validation)"
    
    print_test "Attempting to set API URL to localhost"
    
    # Test localhost
    php -r "
        \$url = 'http://localhost/api';
        \$parsed = parse_url(\$url);
        
        if (!isset(\$parsed['scheme']) || \$parsed['scheme'] !== 'https') {
            echo 'BLOCKED: HTTP scheme';
            exit(0);
        }
        
        \$host = \$parsed['host'] ?? '';
        if (in_array(strtolower(\$host), ['localhost', '127.0.0.1', '::1'], true)) {
            echo 'BLOCKED: Localhost URL';
            exit(0);
        }
        
        echo 'FAIL: Should have blocked';
        exit(1);
    " 2>/dev/null
    
    if [ $? -eq 0 ]; then
        print_pass "SSRF prevention working (localhost blocked)"
    else
        print_fail "SSRF prevention not working (localhost allowed)"
    fi
    
    # Test private IP
    print_test "Attempting to set API URL to private IP (192.168.1.1)"
    
    php -r "
        \$url = 'https://192.168.1.1/api';
        \$parsed = parse_url(\$url);
        \$host = \$parsed['host'] ?? '';
        \$ip = gethostbyname(\$host);
        
        if (filter_var(\$ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
            echo 'BLOCKED: Private IP';
            exit(0);
        }
        
        echo 'FAIL: Should have blocked';
        exit(1);
    " 2>/dev/null
    
    if [ $? -eq 0 ]; then
        print_pass "SSRF prevention working (private IP blocked)"
    else
        print_fail "SSRF prevention not working (private IP allowed)"
    fi
}

test_error_responses() {
    print_header "Test 4: Error Response Standardization"
    
    print_test "Testing 401 Unauthorized response format"
    
    response=$(curl -s "$API_URL/v1/estimate" \
        -H "Content-Type: application/json" \
        -H "X-API-Key: invalid_key_12345" \
        -d '{"content": "test", "source_lang": "en", "target_langs": ["es"]}' 2>/dev/null)
    
    if echo "$response" | grep -q '"success":false' && echo "$response" | grep -q '"error":{'; then
        print_pass "401 response has standard format"
    else
        print_fail "401 response format incorrect"
    fi
    
    print_test "Testing 429 Rate Limit response format"
    print_info "Skipping (requires actual rate limiting trigger)"
    TESTS_TOTAL=$((TESTS_TOTAL - 1))
}

test_integration() {
    print_header "Test 5: Integration with Backend API"
    
    print_test "Testing /v1/estimate endpoint availability"
    
    response=$(curl -s -w "\n%{http_code}" "$API_URL/v1/estimate" \
        -H "Content-Type: application/json" \
        -H "X-API-Key: test_key" \
        -d '{"content": "<p>Hello world</p>", "source_lang": "en", "target_langs": ["es"]}' 2>/dev/null)
    
    http_code=$(echo "$response" | tail -n1)
    
    if [ "$http_code" = "200" ] || [ "$http_code" = "401" ]; then
        print_pass "Backend API is reachable"
    else
        print_fail "Backend API unreachable (HTTP $http_code)"
    fi
    
    print_test "Testing /v1/stats/accuracy endpoint"
    
    response=$(curl -s -w "\n%{http_code}" "$API_URL/v1/stats/accuracy" \
        -H "X-API-Key: test_key" 2>/dev/null)
    
    http_code=$(echo "$response" | tail -n1)
    
    if [ "$http_code" = "200" ] || [ "$http_code" = "401" ]; then
        print_pass "Accuracy stats endpoint is reachable"
    else
        print_fail "Accuracy stats endpoint unreachable (HTTP $http_code)"
    fi
}

test_anomaly_detection() {
    print_header "Test 6: Anomaly Detection"
    
    print_test "Testing burst detection (>10 requests in 1 minute)"
    
    print_info "Sending 15 rapid requests to webhook..."
    
    local burst_count=0
    for i in {1..15}; do
        curl -s -X POST "$WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -d "{\"job_id\": \"test_$i\", \"status\": \"completed\"}" \
            >/dev/null 2>&1 &
        burst_count=$((burst_count + 1))
    done
    
    wait
    
    print_info "Sent $burst_count burst requests"
    print_pass "Burst requests sent (check anomaly logs)"
}

test_security_log_page() {
    print_header "Test 7: Security Log Page"
    
    print_test "Testing security log page accessibility"
    
    print_info "Security log page should be accessible at:"
    print_info "  /wp-admin/admin.php?page=presszone-translate-security-log"
    
    print_info "Features to verify manually:"
    print_info "  1. Menu item appears under Tools → Security Log"
    print_info "  2. Page loads without errors"
    print_info "  3. Filter dropdowns (Severity, Type) work"
    print_info "  4. Pagination displays correctly"
    print_info "  5. Anomalies table shows data"
    print_info "  6. 'View Details' expands JSON data"
    
    print_pass "Security log page implemented (manual verification required)"
}

# Main execution
main() {
    clear
    print_header "TRANSLATE PRESS ZONE - SECURITY FEATURES TEST SUITE"
    
    echo -e "${BLUE}Starting security tests...${NC}\n"
    echo -e "Configuration:"
    echo -e "  Webhook URL: $WEBHOOK_URL"
    echo -e "  API URL: $API_URL"
    echo ""
    
    # Clear previous results
    > "$TEST_RESULTS_FILE"
    
    # Run tests
    test_rate_limiting 2>&1 | tee -a "$TEST_RESULTS_FILE"
    test_xss_prevention 2>&1 | tee -a "$TEST_RESULTS_FILE"
    test_ssrf_prevention 2>&1 | tee -a "$TEST_RESULTS_FILE"
    test_error_responses 2>&1 | tee -a "$TEST_RESULTS_FILE"
    test_integration 2>&1 | tee -a "$TEST_RESULTS_FILE"
    test_anomaly_detection 2>&1 | tee -a "$TEST_RESULTS_FILE"
    test_security_log_page 2>&1 | tee -a "$TEST_RESULTS_FILE"
    
    # Summary
    print_header "TEST SUMMARY"
    
    echo -e "Total tests:  $TESTS_TOTAL"
    echo -e "${GREEN}Passed:       $TESTS_PASSED${NC}"
    echo -e "${RED}Failed:       $TESTS_FAILED${NC}"
    echo ""
    
    if [ $TESTS_FAILED -eq 0 ]; then
        echo -e "${GREEN}✓ All tests passed!${NC}"
        echo ""
        exit 0
    else
        echo -e "${RED}✗ Some tests failed. Check output above.${NC}"
        echo ""
        exit 1
    fi
}

# Run main
main "$@"