#!/usr/bin/env bash
# Live: the cocore actions against cocore.dev as $HANDLE (its app password in the env var $PASSWORD_ENV).
# Inference is authorized by a service-auth token the host mints from that session (ATLIBS_HTTP serviceAuth);
# an account that never connected co/core gets onboarding_required, which counts as the expected answer
# unless REQUIRE_ONBOARDED=1. The API key the keys actions create is revoked and deleted; its secret is never printed.
# ATLIBS picks the binary (atlibs, or "node ../atlibs/javascript/src/server/cli.mjs run" with wasm + module.json);
# the session is kept in a fresh ATLIBS_SERVER_STATE, removed at the end.
set -euo pipefail
cd "$(dirname "$0")/.."
: "${HANDLE:?HANDLE=you.bsky.social}" "${PASSWORD_ENV:?PASSWORD_ENV=<name of the env var holding the app password>}"
ATLIBS=${ATLIBS:-atlibs run}
export ATLIBS_SERVER_STATE=$(mktemp -d)
export ATLIBS_HTTP='{"https://cocore.dev":{"serviceAuth":{"aud":"did:web:cocore.dev","lxm":"dev.cocore.inference.dispatch"}}}'

FAILED=$(mktemp)
trap 'rm -rf "$ATLIBS_SERVER_STATE" "$FAILED"' EXIT

# run <module> <entry> [json]: the run's JSON. A failed run is reported and counted (unless ALLOW_FAIL=1).
run() {
	local input=${3:-} out status=0
	[ -n "$input" ] || input='{}'
	out=$(env -u ATPROTO_HANDLE -u ATPROTO_PASSWORD -u ATP_USERNAME -u ATP_PASSWORD -u ATPROTO_PDS \
		$ATLIBS "modules/$1" "$2" "$input" --app-password "$HANDLE" --password-env "$PASSWORD_ENV" 2>/dev/null) || status=$?
	if [ "$status" -ne 0 ] && [ "${ALLOW_FAIL:-}" != 1 ]; then
		echo "FAIL $1 $2: $(jq -r .error <<<"$out" 2>/dev/null || echo "$out")" | tee -a "$FAILED" >&2
	fi
	echo "$out"
}
step() { printf '%-40s %s\n' "$1" "$2"; }

# cocore-inference: the public directory, then the stub model as this account
step "inference models" "$(run cocore-inference models | jq -c '{models: (.result.data | length), stub: any(.result.data[]; .id == "stub")}')"
chat=$(ALLOW_FAIL=1 run cocore-inference chat '{"model":"stub","prompt":"Say hi.","maxTokens":"16"}')
step "inference chat (stub)" "$(jq -c '{text: .result.text, finishReason: .result.finishReason, error}' <<<"$chat")"
chat=$(ALLOW_FAIL=1 run cocore-inference chat '{"model":"stub","prompt":"Say hi.","maxTokens":"16","stream":"true"}')
step "inference chat (stub, streamed)" "$(jq -c '{text: .result.text, finishReason: .result.finishReason, error}' <<<"$chat")"
if jq -e '.error | strings | contains("onboarding_required")' <<<"$chat" >/dev/null; then
	[ "${REQUIRE_ONBOARDED:-}" != 1 ] || echo "FAIL inference: $HANDLE is not onboarded" >>"$FAILED"
	step "inference" "not onboarded: onboarding_required (expected for an account that never connected co/core)"
elif ! jq -e '.result.text | strings' <<<"$chat" >/dev/null; then
	echo "FAIL inference chat: $(jq -r .error <<<"$chat")" >>"$FAILED"
fi

# cocore-keys: create one, see it, revoke and delete it. The secret is never printed.
step "keys list_keys" "$(run cocore-keys list_keys | jq -c '{keys: (.result.keys | length)}')"
created=$(run cocore-keys create_key '{"name":"atlibs-cocore live test"}')
id=$(jq -r .result.key.id <<<"$created")
step "keys create_key" "$(jq -c '{id: .result.key.id, prefix: .result.key.prefix, secret: (.result.secret | startswith("cocore-"))}' <<<"$created")"
step "keys list_keys (has it)" "$(run cocore-keys list_keys | jq -c --arg id "$id" '{listed: any(.result.keys[]; .id == $id)}')"
step "keys revoke_key" "$(run cocore-keys revoke_key "{\"id\":\"$id\"}" | jq -c .result)"
step "keys delete_key" "$(run cocore-keys delete_key "{\"id\":\"$id\"}" | jq -c .result)"
step "keys list_keys (gone)" "$(run cocore-keys list_keys | jq -c --arg id "$id" '{listed: any(.result.keys[]; .id == $id)}')"

[ ! -s "$FAILED" ] || { cat "$FAILED" >&2; echo "$(wc -l <"$FAILED" | tr -d ' ') failed" >&2; exit 1; }
echo "all passed"