#!/usr/bin/env bash
# Start a local Mosquitto MQTT broker in Docker for integration testing.
# Provides 3 listeners: plain (1883), TLS (8883), auth (1884).
set -e

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
CERT_DIR="$SCRIPT_DIR/certs"
CONTAINER_NAME="cic-mqtt-test"

# Stop existing container if running
docker rm -f "$CONTAINER_NAME" 2>/dev/null || true

# Generate self-signed TLS certs if missing
if [ ! -f "$CERT_DIR/server.crt" ]; then
  echo "Generating self-signed TLS certificates..."
  mkdir -p "$CERT_DIR"

  # CA key + cert
  openssl genrsa -out "$CERT_DIR/ca.key" 2048 2>/dev/null
  openssl req -x509 -new -nodes -key "$CERT_DIR/ca.key" \
    -sha256 -days 3650 -out "$CERT_DIR/ca.crt" \
    -subj "//CN=CIC Test CA" 2>/dev/null

  # Server key + cert signed by CA
  openssl genrsa -out "$CERT_DIR/server.key" 2048 2>/dev/null
  openssl req -new -key "$CERT_DIR/server.key" \
    -out "$CERT_DIR/server.csr" \
    -subj "//CN=localhost" 2>/dev/null
  openssl x509 -req -in "$CERT_DIR/server.csr" \
    -CA "$CERT_DIR/ca.crt" -CAkey "$CERT_DIR/ca.key" \
    -CAcreateserial -out "$CERT_DIR/server.crt" \
    -days 3650 -sha256 2>/dev/null
  rm -f "$CERT_DIR/server.csr" "$CERT_DIR/ca.srl"

  echo "Certificates generated in $CERT_DIR"
fi

# Generate password file if missing
PASSWD_FILE="$SCRIPT_DIR/passwd"
if [ ! -f "$PASSWD_FILE" ]; then
  echo "Generating password file..."
  MSYS_NO_PATHCONV=1 docker run --rm -v "$SCRIPT_DIR:/work" eclipse-mosquitto \
    mosquitto_passwd -b -c /work/passwd rw readwrite
  MSYS_NO_PATHCONV=1 docker run --rm -v "$SCRIPT_DIR:/work" eclipse-mosquitto \
    mosquitto_passwd -b /work/passwd ro readonly
  echo "Password file generated."
fi

# Build combined config directory (mosquitto.conf + passwd in one dir)
CONFIG_DIR="$SCRIPT_DIR/config"
mkdir -p "$CONFIG_DIR"
cp "$SCRIPT_DIR/mosquitto.conf" "$CONFIG_DIR/mosquitto.conf"
cp "$PASSWD_FILE" "$CONFIG_DIR/passwd"

echo "Starting Mosquitto broker ($CONTAINER_NAME)..."
MSYS_NO_PATHCONV=1 docker run -d \
  --name "$CONTAINER_NAME" \
  -p 1883:1883 \
  -p 8883:8883 \
  -p 1884:1884 \
  -v "$CONFIG_DIR:/mosquitto/config:ro" \
  -v "$CERT_DIR:/mosquitto/certs:ro" \
  eclipse-mosquitto

# Wait for broker to be ready
echo -n "Waiting for broker..."
for i in $(seq 1 10); do
  if docker exec "$CONTAINER_NAME" mosquitto_pub -t test/ping -m "ping" -q 0 2>/dev/null; then
    echo " ready."
    echo ""
    echo "Broker is running:"
    echo "  Plain MQTT:  localhost:1883 (no auth)"
    echo "  TLS MQTT:    localhost:8883 (self-signed cert)"
    echo "  Auth MQTT:   localhost:1884 (user: rw / pass: readwrite)"
    echo ""
    echo "Stop with: docker rm -f $CONTAINER_NAME"
    exit 0
  fi
  echo -n "."
  sleep 1
done

echo " timeout!"
echo "Broker logs:"
docker logs "$CONTAINER_NAME" 2>&1 | tail -20
exit 1