#!/usr/bin/env bash
# Troubleshoot E2E RPC HTTP failures (405 at edge); tests 7 primary FQDNs (+ optional --lan NPM Host checks).
# Usage: bash scripts/verify/troubleshoot-rpc-failures.sh [--lan]
#   --lan  Also test NPMplus direct (192.168.11.167) with Host header; requires LAN access.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
cd "$PROJECT_ROOT"
source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true

NPMPLUS_IP="${IP_NGINX_PROXY_MANAGER:-192.168.11.167}"
RPC_DOMAINS=(
    "rpc-http-pub.d-bis.org"
    "rpc.public-0138.defi-oracle.io"
    "rpc.d-bis.org"
    "rpc2.d-bis.org"
    "rpc-http-prv.d-bis.org"
    "rpc-core.d-bis.org"
    "rpc.defi-oracle.io"
)
RPC_BODY='{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}'
TEST_LAN=false
[[ "${1:-}" == "--lan" ]] && TEST_LAN=true

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
ok()   { echo -e "${GREEN}[✓]${NC} $1"; }
fail() { echo -e "${RED}[✗]${NC} $1"; }
warn() { echo -e "${YELLOW}[⚠]${NC} $1"; }
info() { echo -e "${BLUE}[INFO]${NC} $1"; }

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "Troubleshoot RPC E2E failures (POST → public IP)"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

# 1) Via public FQDN (what E2E uses) — usually 405 from edge
info "1. Testing POST via public FQDN (same path as E2E)"
for domain in "${RPC_DOMAINS[@]}"; do
    code=$(curl -s -X POST "https://$domain" \
        -H 'Content-Type: application/json' \
        -d "$RPC_BODY" \
        --connect-timeout 10 -k -w "%{http_code}" -o /tmp/rpc_troubleshoot_body.txt 2>/dev/null || echo "000")
    body=$(head -c 120 /tmp/rpc_troubleshoot_body.txt 2>/dev/null || echo "")
    if [ "$code" = "200" ] && grep -q '"result"' /tmp/rpc_troubleshoot_body.txt 2>/dev/null; then
        ok "$domain → HTTP $code (chainId present)"
    else
        fail "$domain → HTTP $code  $body"
    fi
done

# 2) Optional: direct to NPMplus from LAN (confirms backend allows POST)
if [ "$TEST_LAN" = true ]; then
    echo ""
    info "2. Testing POST direct to NPMplus ($NPMPLUS_IP) with Host header (LAN only)"
    for domain in "${RPC_DOMAINS[@]}"; do
        code=$(curl -s -X POST "https://$NPMPLUS_IP/" \
            -H "Host: $domain" \
            -H 'Content-Type: application/json' \
            -d "$RPC_BODY" \
            --connect-timeout 5 -k -w "%{http_code}" -o /tmp/rpc_troubleshoot_lan.txt 2>/dev/null || echo "000")
        if [ "$code" = "200" ] && grep -q '"result"' /tmp/rpc_troubleshoot_lan.txt 2>/dev/null; then
            ok "$domain (Host) → $NPMPLUS_IP HTTP $code"
        else
            warn "$domain (Host) → $NPMPLUS_IP HTTP $code (unreachable if not on LAN)"
        fi
    done
else
    echo ""
    info "2. Skip direct NPMplus test. Run with --lan to test POST to $NPMPLUS_IP (requires LAN)."
fi

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
info "Summary: 405 = edge (UDM Pro) blocking POST. Fix: allow POST on edge or use Cloudflare Tunnel for RPC."
info "See: docs/05-network/E2E_RPC_EDGE_LIMITATION.md"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""