#!/usr/bin/env bash
# 07-webpush.sh — clave pública VAPID y alta de una suscripción de ejemplo.
#
# Demuestra:
#   * GET /api/push/vapid-key: la primera llamada GENERA el par VAPID (perezoso);
#     la segunda devuelve el MISMO par.
#   * POST /api/push/subscriptions con una suscripción válida -> 201 {"id"}
#     (p256dh = punto P-256 uncompressed de 65 bytes; auth = 16 bytes).
#   * upsert por endpoint: repetir la misma suscripción conserva el `id`.
#   * endpoint http:// -> 400; p256dh mal formado -> 400.
#
# La p256dh de ejemplo se genera aquí con `cryptography` (punto P-256 real).
# Si no estuviera disponible, se documenta el intento y el error real.
#
# Uso:  ./07-webpush.sh
set -euo pipefail

BASE="${VALET_BASE:-http://127.0.0.1:3458}"
WORK="${WORKDIR:-/tmp/opencode/valet-847}"
EP="https://push.example.test/demo-endpoint-847"

# --- Genera una p256dh (65 bytes) y un auth (16 bytes) reales ---
eval "$(python3 - <<'PY'
import base64, os
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import serialization
priv = ec.generate_private_key(ec.SECP256R1())
pub = priv.public_key().public_bytes(serialization.Encoding.X962,
      serialization.PublicFormat.UncompressedPoint)   # 0x04 || X || Y = 65 bytes
assert len(pub) == 65, len(pub)
b64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b'=').decode()
print("P256DH=%s" % b64(pub))
print("AUTH=%s"   % b64(os.urandom(16)))
PY
)"

echo "== GET /api/push/vapid-key (1ª llamada: genera el par) =="
curl -s -w "\n[%{http_code}]\n" "$BASE/api/push/vapid-key"

echo
echo "== GET /api/push/vapid-key (2ª llamada: mismo par) =="
curl -s -w "\n[%{http_code}]\n" "$BASE/api/push/vapid-key"

echo
echo "== POST /api/push/subscriptions (suscripción válida) =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/push/subscriptions" \
  -H "Content-Type: application/json" -A "DemoUA/1.0" \
  -d "{\"endpoint\":\"$EP\",\"keys\":{\"p256dh\":\"$P256DH\",\"auth\":\"$AUTH\"}}"

echo
echo "== repetir la misma endpoint: upsert conserva el id =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/push/subscriptions" \
  -H "Content-Type: application/json" -A "DemoUA/2.0" \
  -d "{\"endpoint\":\"$EP\",\"keys\":{\"p256dh\":\"$P256DH\",\"auth\":\"$AUTH\"}}"

echo
echo "== 400: endpoint http:// =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/push/subscriptions" \
  -H "Content-Type: application/json" \
  -d "{\"endpoint\":\"http://push.example.test/x\",\"keys\":{\"p256dh\":\"$P256DH\",\"auth\":\"$AUTH\"}}"

echo
echo "== 400: p256dh mal formado =="
curl -s -w "\n[%{http_code}]\n" -X POST "$BASE/api/push/subscriptions" \
  -H "Content-Type: application/json" \
  -d "{\"endpoint\":\"$EP\",\"keys\":{\"p256dh\":\"AAAA\",\"auth\":\"$AUTH\"}}"