#!/usr/bin/env bash
# 02-enviar-notificacion.sh — ingesta autenticada con la clave del paso 01.
#
# Demuestra:
#   * POST /api/notifications con token -> 201 + {"id"}
#   * Sin cabecera Authorization      -> 401 {"error":"unauthorized"}
#   * Token inventado                 -> 401 (mismo cuerpo, indistinguible)
#
# Uso:  ./02-enviar-notificacion.sh
set -euo pipefail

BASE="${VALET_BASE:-http://127.0.0.1:3458}"
WORK="${WORKDIR:-/tmp/opencode/valet-847}"
TOKEN="$(cat "$WORK/token.txt")"

echo "== POST /api/notifications  (Authorization: Bearer val_XXXXXXXX<…>) =="
RAW=$(curl -s -w $'\n%{http_code}' -X POST "$BASE/api/notifications" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"message":"Backup terminado con 3 avisos","origin":"backup-host","author":"nightly-job","level":"warning","metadata":{"warnings":3}}')
BODY=$(printf '%s' "$RAW" | head -n1)
CODE=$(printf '%s' "$RAW" | tail -n1)
echo "$BODY"
echo "[$CODE]"
# Guarda el id de la notificación para los pasos siguientes.
printf '%s' "$BODY" | python3 -c 'import sys,json;print(json.load(sys.stdin)["id"])' > "$WORK/nid.txt"

echo
echo "== sin cabecera Authorization -> 401 =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/notifications" \
  -H "Content-Type: application/json" -d '{"message":"x"}'

echo
echo "== Bearer con token inventado -> 401 (mismo cuerpo) =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/notifications" \
  -H "Authorization: Bearer val_estoNoExiste000000000000000000000000000000" \
  -H "Content-Type: application/json" -d '{"message":"x"}'

echo
echo "== Authorization mal formada (sin 'Bearer ') -> 401 =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/notifications" \
  -H "Authorization: val_algo" \
  -H "Content-Type: application/json" -d '{"message":"x"}'