#!/bin/bash
# Tes end-to-end via HTTP. Butuh: server di :8099 dan storage/pins.txt
B=http://127.0.0.1:8099/api/index.php; P=/tmp/out/app/storage/pins.txt
pin(){ grep "^$1" $P | awk '{print $3}'; }
pass=0; failn=0
chk(){ if echo "$2" | grep -q "$3"; then pass=$((pass+1)); echo "PASS $1"; else failn=$((failn+1)); echo "FAIL $1 :: $2"; fi; }
login(){ J=/tmp/out/app/storage/j_$1; rm -f $J; R=$(curl -s -c $J -H 'Content-Type: application/json' -d "{\"nik\":\"$2\",\"pin\":\"$(pin $2)\"}" "$B?r=login"); echo "$R" | sed 's/.*"csrf":"\([^"]*\)".*/\1/'; }
post(){ curl -s -b /tmp/out/app/storage/j_$1 -H "X-CSRF: $2" -H 'Content-Type: application/json' -d "$4" "$B?r=$3"; }
get(){ curl -s -b /tmp/out/app/storage/j_$1 "$B?r=$2"; }

R=$(curl -s -H 'Content-Type: application/json' -d '{"nik":"pic01","pin":"000000"}' "$B?r=login"); chk "login salah ditolak" "$R" '"ok":false'
R=$(curl -s "$B?r=brangkas"); chk "tanpa login 401" "$R" 'Belum login'
KC=$(login k kasir.ambo1); PC=$(login p pic01); GC=$(login g gdg01)
R=$(post k "$KC" setoran/kirim '{"shift":1,"nominal":"1.500.000"}'); chk "kasir kirim s1" "$R" '"ok":true'
R=$(post k "$KC" setoran/kirim '{"shift":1,"nominal":1600000}'); chk "kirim ulang = ubah" "$R" '"ok":true'
R=$(post k "$KC" setoran/kirim '{"shift":2,"nominal":2000000}'); chk "kasir kirim s2" "$R" '"ok":true'
R=$(post k "bad" setoran/kirim '{"shift":3,"nominal":1}'); chk "csrf salah ditolak" "$R" 'Token keamanan'
R=$(get k brangkas); chk "kasir tak boleh lihat brangkas" "$R" 'Tidak punya akses'
R=$(get p brangkas); chk "brangkas terkunci sebelum PIN" "$R" 'terkunci'
R=$(post p "$PC" brangkas/buka '{"pin":"111111"}'); chk "PIN salah ditolak" "$R" 'PIN salah'
R=$(post p "$PC" brangkas/buka "{\"pin\":\"$(pin pic01)\"}"); chk "buka brangkas dengan PIN" "$R" '"ok":true'
php -r 'require "/tmp/out/app/src/bootstrap.php"; require "/tmp/out/app/src/Auth.php"; db()->prepare("INSERT INTO users (nik,nama,role,pin_hash,lihat_saldo) VALUES (?,?,?,?,0)")->execute(["pic03","PIC Biasa","pic",Auth::hashPin("565656")]);'
echo "pic03	PIN: 565656" >> $P
C3=$(login c pic03)
R=$(post c "$C3" brangkas/buka '{"pin":"565656"}'); chk "PIC tanpa izin ditolak buka brangkas" "$R" 'Tidak punya akses'
R=$(get c brangkas); chk "PIC tanpa izin tak bisa lihat saldo" "$R" 'Tidak punya akses'
R=$(get c mutasi); chk "PIC tanpa izin tak bisa lihat mutasi" "$R" 'Tidak punya akses'
R=$(get p "setoran/antrean"); chk "antrean 2 baris" "$(echo "$R" | grep -o '"id"' | wc -l)" '^2$'
ID1=$(echo "$R" | grep -o "\"id\":[0-9]*" | head -1 | grep -o "[0-9]*"); ID2=$(echo "$R" | grep -o "\"id\":[0-9]*" | tail -1 | grep -o "[0-9]*")
R=$(post p "$PC" setoran/terima "{\"items\":[{\"id\":$ID1,\"diterima\":1590000}]}"); chk "selisih tanpa catatan ditolak" "$R" 'isi catatan'
R=$(post p "$PC" setoran/terima "{\"items\":[{\"id\":$ID1,\"diterima\":1590000,\"catatan\":\"kurang 10rb\"},{\"id\":$ID2}]}"); chk "terima semua" "$R" '"selisih":-10000'
R=$(get c "setoran/antrean"); chk "PIC tanpa izin tetap bisa lihat antrean" "$R" '"ok":true'
R=$(get p brangkas); chk "saldo 3.590.000" "$R" '"saldo":"3590000"\|"saldo":3590000'
R=$(post p "$PC" setoran/terima "{\"items\":[{\"id\":$ID2}]}"); chk "terima dobel ditolak" "$R" 'sudah diproses'
R=$(post g "$GC" nota/tambah '{"supplier_id":1,"tanggal":"2026-10-21","jumlah":2500000}'); chk "gudang input nota" "$R" '"ok":true'
R=$(post g "$GC" nota/tambah '{"supplier_id":1,"tanggal":"2026-10-21","jumlah":2500000}'); chk "duplikat ditolak" "$R" 'sudah ada'
R=$(post g "$GC" nota/tambah '{"supplier_id":1,"tanggal":"2026-10-24","jumlah":1000000}'); chk "nota 2" "$R" '"ok":true'
R=$(get g brangkas); chk "gudang tak boleh brangkas" "$R" 'Tidak punya akses'
R=$(get p "nota/belum&supplier=1"); chk "2 nota belum" "$(echo "$R" | grep -o '"jumlah"' | wc -l)" '^2$'
R=$(post p "$PC" nota/bayar '{"ref":"ref-test-0001","supplier_id":1,"nota_ids":[1,2],"metode":"Setor BSI","tanggal":"2026-10-25"}'); chk "bayar nota + slip" "$R" 'NOTA PAK HASAN'
echo "$R" | grep -o '"slip":"[^"]*"'
R=$(post p "$PC" nota/bayar '{"ref":"ref-test-0001","supplier_id":1,"nota_ids":[1,2],"metode":"Setor BSI"}'); chk "ref sama = duplikat aman" "$R" '"duplikat":true'
R=$(post p "$PC" nota/bayar '{"ref":"ref-test-0002","supplier_id":1,"nota_ids":[1],"metode":"Setor BSI"}'); chk "nota lunas ditolak" "$R" 'sudah lunas'
R=$(get p brangkas); chk "saldo 90.000" "$R" '"saldo":"90000"\|"saldo":90000'
R=$(post p "$PC" nota/batal-bayar '{"id":1,"alasan":"salah supplier"}'); chk "batal bayar" "$R" '"ok":true'
R=$(get p brangkas); chk "saldo balik 3.590.000" "$R" '3590000'
R=$(get p "nota/belum&supplier=1"); chk "nota kembali belum" "$(echo "$R" | grep -o '"jumlah"' | wc -l)" '^2$'
R=$(post p "$PC" keluar '{"kategori":"Gaji","nominal":100000,"keterangan":"tes"}'); chk "keluar gaji" "$R" '"ok":true'
R=$(post p "$PC" batalkan '{"id":1}'); chk "tak bisa batal mutasi setoran" "$R" 'setoran'

# ---- ingest dari Apps Script kasir ----
(php tools/toko_key.php AMBO1; php tools/toko_key.php AMBO3) > storage/keys.txt
K=$(grep '^AMBO1' storage/keys.txt | awk '{print $2}'); K3=$(grep '^AMBO3' storage/keys.txt | awk '{print $2}')
ing(){ curl -s -H "X-Toko-Kode: $1" -H "X-Toko-Key: $2" -H 'Content-Type: application/json' -d "$3" "$B?r=ingest/setoran"; }
TGL=$(date +%F)
R=$(ing AMBO1 salah '{"tanggal":"'$TGL'","shift":"Shift 3","kasir":"Sari","setoran":900000}'); chk "kunci salah ditolak" "$R" 'Kunci toko salah'
R=$(ing AMBO1 "$K3" '{"tanggal":"'$TGL'","shift":"Shift 3","kasir":"Sari","setoran":900000}'); chk "kunci toko lain ditolak" "$R" 'Kunci toko salah'
R=$(ing AMBO3 "$K3" '{"tanggal":"'$TGL'","shift":"Shift 3","kasir":"Sari","setoran":900000,"catatan":"ok"}'); chk "ingest baru" "$R" '"aksi":"baru"'
R=$(ing AMBO3 "$K3" '{"tanggal":"'$TGL'","shift":"Shift 3","kasir":"Sari","setoran":950000}'); chk "ingest ulang = diubah" "$R" '"aksi":"diubah"'
R=$(ing AMBO3 "$K3" '{"tanggal":"'$TGL'","shift":"Shift 9","kasir":"Sari","setoran":1}'); chk "shift invalid" "$R" 'Shift tidak valid'
R=$(ing AMBO3 "$K3" '{"tanggal":"'$TGL'","shift":"Shift 2","kasir":"Sari","setoran":0}'); chk "setoran 0 diabaikan" "$R" '"abaikan":true'
R=$(get p "setoran/antrean"); chk "ingest tampil di antrean (nominal 950000, kasir Sari)" "$R" '"nominal_sistem":950000.*\|"kasir":"Sari"'
IDI=$(echo "$R" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
R=$(post p "$PC" setoran/terima "{\"items\":[{\"id\":$IDI}]}"); chk "PIC terima setoran ingest" "$R" '"selisih":0'
R=$(ing AMBO3 "$K3" '{"tanggal":"'$TGL'","shift":"Shift 3","kasir":"Sari","setoran":100}'); chk "setelah diterima, ingest tak menimpa" "$R" '"terkunci":true'
# lockout
for i in 1 2 3 4 5; do curl -s -H 'Content-Type: application/json' -d '{"nik":"owner01","pin":"111111"}' "$B?r=login" >/dev/null; done
R=$(curl -s -H 'Content-Type: application/json' -d "{\"nik\":\"owner01\",\"pin\":\"$(pin owner01)\"}" "$B?r=login"); chk "akun terkunci setelah 5 gagal" "$R" 'terkunci'
echo "== PASS $pass / FAIL $failn =="