#!/usr/bin/env bash
#
# prx integration test.
#
# Exercises the real nftables and policy-routing layer on the local host:
#   on -> assert rules exist -> on again (idempotent) -> off -> assert clean.
#
# The proxy engine is skipped (--skip-engine) so this does not require sing-box.
# Run it with root, e.g.:
#
#   sudo -E PRX_BIN="$PWD/bin/prx" ./scripts/integration-test.sh
#
set -euo pipefail

BIN="${PRX_BIN:-$(pwd)/bin/prx}"

if [[ ! -x "$BIN" ]]; then
  echo "prx binary not found at $BIN (build it first: make build)" >&2
  exit 1
fi
if [[ "${EUID}" -ne 0 ]]; then
  echo "this test needs root; re-run with sudo -E $0" >&2
  exit 1
fi

TMP="$(mktemp -d)"
CONFIG="$TMP/config.json"
STATE="$TMP/state.json"

cat >"$CONFIG" <<EOF
{
  "state": { "path": "$STATE" }
}
EOF

PRX=("$BIN" --config "$CONFIG")

cleanup() {
  echo "--- cleanup ---"
  "${PRX[@]}" off >/dev/null 2>&1 || true
  rm -rf "$TMP"
}
trap cleanup EXIT

pass() { echo "  ok: $1"; }
fail() { echo "  FAIL: $1" >&2; exit 1; }

rule_count() {
  ip rule show | grep -c "fwmark 0x100" || true
}

echo "--- enabling (skip engine) ---"
"${PRX[@]}" on --skip-engine

echo "--- assertions after on ---"
nft list table inet prx >/dev/null 2>&1 || fail "nftables table inet prx missing"
pass "nftables table inet prx present"

ip rule show | grep -q "fwmark 0x100 lookup 100" || fail "policy rule missing"
pass "policy rule present"

ip route show table 100 | grep -q "^default via" || fail "table 100 has no default route"
pass "table 100 default route present"

[[ "$(rule_count)" -eq 1 ]] || fail "expected exactly one mark rule, got $(rule_count)"
pass "exactly one mark rule"

echo "--- enabling again (idempotency) ---"
"${PRX[@]}" on --skip-engine
[[ "$(rule_count)" -eq 1 ]] || fail "duplicate rule after second on ($(rule_count))"
pass "no duplicate rule after second on"

nft list table inet prx | grep -c "meta mark set" >/dev/null || fail "nft rules missing"
pass "nft rules intact after re-apply"

echo "--- status ---"
"${PRX[@]}" status

echo "--- disabling ---"
"${PRX[@]}" off

echo "--- assertions after off ---"
if nft list table inet prx >/dev/null 2>&1; then
  fail "nftables table inet prx still present after off"
fi
pass "nftables table removed"

[[ "$(rule_count)" -eq 0 ]] || fail "policy rule still present after off"
pass "policy rule removed"

echo "--- disabling again (idempotency) ---"
"${PRX[@]}" off
pass "second off succeeded"

echo
echo "ALL INTEGRATION CHECKS PASSED"