#!/bin/bash

echo "🔐 测试修改密码功能"
echo "===================="
echo ""

BASE_URL="http://localhost:3000"

# 1. 注册测试用户
TIMESTAMP=$(date +%s)
TEST_EMAIL="password-test-$TIMESTAMP@example.com"
TEST_PASSWORD="oldpassword123"
NEW_PASSWORD="newpassword123"

echo "1️⃣ 注册测试用户: $TEST_EMAIL"
REGISTER_RESPONSE=$(curl -s -X POST "$BASE_URL/api/auth/register" \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"$TEST_EMAIL\",\"password\":\"$TEST_PASSWORD\",\"name\":\"密码测试用户\"}")

echo "注册响应: $REGISTER_RESPONSE"
echo ""

# 2. 获取 CSRF token
echo "2️⃣ 获取 CSRF token..."
CSRF_RESPONSE=$(curl -s -c cookies.txt -b cookies.txt "$BASE_URL/api/auth/csrf")
CSRF_TOKEN=$(echo $CSRF_RESPONSE | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)
echo "CSRF Token: $CSRF_TOKEN"
echo ""

# 3. 登录
echo "3️⃣ 登录..."
LOGIN_RESPONSE=$(curl -s -c cookies.txt -b cookies.txt -X POST "$BASE_URL/api/auth/callback/credentials" \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"$TEST_EMAIL\",\"password\":\"$TEST_PASSWORD\",\"csrfToken\":\"$CSRF_TOKEN\",\"callbackUrl\":\"$BASE_URL\",\"json\":true}")

echo "登录成功"
echo ""

# 4. 测试修改密码（错误的当前密码）
echo "4️⃣ 测试错误的当前密码..."
WRONG_PASSWORD_RESPONSE=$(curl -s -b cookies.txt -X POST "$BASE_URL/api/user/change-password" \
  -H "Content-Type: application/json" \
  -d "{\"currentPassword\":\"wrongpassword\",\"newPassword\":\"$NEW_PASSWORD\",\"confirmPassword\":\"$NEW_PASSWORD\"}")

echo "响应: $WRONG_PASSWORD_RESPONSE"
echo ""

# 5. 测试修改密码（密码不一致）
echo "5️⃣ 测试密码不一致..."
MISMATCH_RESPONSE=$(curl -s -b cookies.txt -X POST "$BASE_URL/api/user/change-password" \
  -H "Content-Type: application/json" \
  -d "{\"currentPassword\":\"$TEST_PASSWORD\",\"newPassword\":\"$NEW_PASSWORD\",\"confirmPassword\":\"different123\"}")

echo "响应: $MISMATCH_RESPONSE"
echo ""

# 6. 测试修改密码（成功）
echo "6️⃣ 正确修改密码..."
SUCCESS_RESPONSE=$(curl -s -b cookies.txt -X POST "$BASE_URL/api/user/change-password" \
  -H "Content-Type: application/json" \
  -d "{\"currentPassword\":\"$TEST_PASSWORD\",\"newPassword\":\"$NEW_PASSWORD\",\"confirmPassword\":\"$NEW_PASSWORD\"}")

echo "响应: $SUCCESS_RESPONSE"
echo ""

# 7. 验证新密码可以登录
echo "7️⃣ 验证新密码登录..."
rm -f cookies.txt

# 重新获取 CSRF token
CSRF_RESPONSE=$(curl -s -c cookies.txt -b cookies.txt "$BASE_URL/api/auth/csrf")
CSRF_TOKEN=$(echo $CSRF_RESPONSE | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)

# 使用新密码登录
NEW_LOGIN_RESPONSE=$(curl -s -c cookies.txt -b cookies.txt -X POST "$BASE_URL/api/auth/callback/credentials" \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"$TEST_EMAIL\",\"password\":\"$NEW_PASSWORD\",\"csrfToken\":\"$CSRF_TOKEN\",\"callbackUrl\":\"$BASE_URL\",\"json\":true}")

echo "使用新密码登录成功"
echo ""

# 8. 验证旧密码无法登录
echo "8️⃣ 验证旧密码无法登录..."
rm -f cookies.txt

# 重新获取 CSRF token
CSRF_RESPONSE=$(curl -s -c cookies.txt -b cookies.txt "$BASE_URL/api/auth/csrf")
CSRF_TOKEN=$(echo $CSRF_RESPONSE | grep -o '"csrfToken":"[^"]*"' | cut -d'"' -f4)

# 使用旧密码登录（应该失败）
OLD_LOGIN_RESPONSE=$(curl -s -w "\n%{http_code}" -c cookies.txt -b cookies.txt -X POST "$BASE_URL/api/auth/callback/credentials" \
  -H "Content-Type: application/json" \
  -d "{\"email\":\"$TEST_EMAIL\",\"password\":\"$TEST_PASSWORD\",\"csrfToken\":\"$CSRF_TOKEN\",\"callbackUrl\":\"$BASE_URL\",\"json\":true}")

echo "旧密码登录响应: $OLD_LOGIN_RESPONSE"
echo ""

# 清理
rm -f cookies.txt

echo "✅ 修改密码功能测试完成！"