#!/usr/bin/env bash
# scripts/region-service-gate.sh <probe-host> <expected-version> [<edge-eip> ...]
#
# Nearest-region spec §17 step 6: before CONSOLE_APP_REGIONS goes on, every
# eligible region must serve a fresh probe instance through the REAL public
# path — from outside through public DNS (skip with GATE_SKIP_PUBLIC=1), and
# through every armed edge that is NOT the instance's box. Passes only on
# 2xx with X-Carlos-Version equal to the deployed build. Proxies are
# disabled and ~/.curlrc ignored, and each explicit-edge check verifies it
# connected to the EIP it named, so no intermediary can stand in for an
# edge. GATE_PORT and GATE_INSECURE exist for tests only.
set -uo pipefail
host="${1:?usage: region-service-gate.sh <probe-host> <expected-version> [<edge-eip> ...]}"
want="${2:?usage: region-service-gate.sh <probe-host> <expected-version> [<edge-eip> ...]}"
shift 2
port="${GATE_PORT:-443}"
insecure=""
[ "${GATE_INSECURE:-}" = 1 ] && insecure="-k"
unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY ALL_PROXY all_proxy
hdr="$(mktemp "${TMPDIR:-/tmp}/region-gate.XXXXXX")"
trap 'rm -f "$hdr"' EXIT
fail=0
check() { # <label> <expected-ip or ""> [curl args...]
  local label="$1" eip="$2"; shift 2
  local out res count ip status version
  # -q must be first: it stops curl reading ~/.curlrc. $insecure is
  # unquoted on purpose so that empty expands to nothing (bash 3.2 safe).
  # The status is curl's own final %{http_code}, never a header that happens
  # to start with "HTTP". The version is read only from the final response's
  # header block: -D also dumps 1xx blocks (103 Early Hints), so the block
  # starts again at every real status line ("HTTP/x.y NNN").
  out="$(curl -q -s $insecure --noproxy '*' -D "$hdr" -o /dev/null -w '%{remote_ip} %{http_code}' --max-time 20 "$@" "https://$host:$port/")" || {
    echo "FAIL $label: request failed"; fail=1; return; }
  read -r ip status <<<"$out"
  if [ -n "$eip" ] && [ "$ip" != "$eip" ]; then
    echo "FAIL $label: connected to $ip, not $eip"; fail=1; return
  fi
  # n counts the version headers in the final block, apart from their values,
  # so an empty value still counts. More than one is a failure.
  res="$(awk -F': *' '/^HTTP\/[0-9.]+ [0-9][0-9][0-9]/ {n=0; v=""; next} tolower($1)=="x-carlos-version" {gsub(/\r/,"",$2); v = (n ? v "," $2 : $2); n++} END {print n+0, v}' "$hdr")"
  count="${res%% *}"; version="${res#* }"
  if [[ "$status" != 2* ]]; then echo "FAIL $label: status $status"; fail=1; return; fi
  if [ "$count" != 1 ] || [ "$version" != "$want" ]; then echo "FAIL $label: X-Carlos-Version '$version', want '$want'"; fail=1; return; fi
  echo "ok   $label: $status $version"
}
[ "${GATE_SKIP_PUBLIC:-}" = 1 ] || check "public DNS" ""
for eip in "$@"; do
  check "via edge $eip" "$eip" --resolve "$host:$port:$eip"
done
exit "$fail"