$base = "http://localhost:3101/api"
$results = @()

function Test-Case($name, $ok, $detail) {
  $script:results += [pscustomobject]@{ Test = $name; Pass = $ok; Detail = $detail }
  $mark = if ($ok) { "PASS" } else { "FAIL" }
  Write-Host "[$mark] $name - $detail"
}

function Login($phone) {
  $body = @{ phone = $phone; password = "123456"; rememberMe = $false } | ConvertTo-Json
  $r = Invoke-RestMethod -Uri "$base/auth/login" -Method POST -Body $body -ContentType "application/json"
  if (-not $r.success) { throw "login failed: $email" }
  return @{ Token = $r.data.token; User = $r.data.user }
}

function Get-Overview($token, $query = "") {
  $h = @{ Authorization = "Bearer $token" }
  $uri = "$base/dashboard/overview"
  if ($query) { $uri = "$uri?$query" }
  try {
    $r = Invoke-RestMethod -Uri $uri -Method GET -Headers $h
    return @{ Ok = $true; Status = 200; Data = $r.data }
  } catch {
    $status = $_.Exception.Response.StatusCode.value__
    $body = $_.ErrorDetails.Message
    return @{ Ok = $false; Status = $status; Body = $body }
  }
}

function Get-Groups($token) {
  $h = @{ Authorization = "Bearer $token" }
  try {
    $r = Invoke-RestMethod -Uri "$base/qiwe/groups" -Method GET -Headers $h
    return @{ Ok = $true; Count = @($r.data.groups).Count; Data = $r.data }
  } catch {
    $status = $_.Exception.Response.StatusCode.value__
    return @{ Ok = $false; Status = $status; Body = $_.ErrorDetails.Message }
  }
}

Write-Host ""
Write-Host "=== P0 Scope Tests ==="
Write-Host ""

try {
  Invoke-RestMethod -Uri "$base/qiwe/groups" -Method GET | Out-Null
  Test-Case "groups without auth rejected" $false "no error"
} catch {
  $st = $_.Exception.Response.StatusCode.value__
  Test-Case "groups without auth rejected" ($st -eq 401) "HTTP $st"
}

$director = Login "13800000001"
$supervisor = Login "13800000002"
$manager = Login "13800000003"

Test-Case "director login" ($director.User.role -eq "director") $director.User.email
Test-Case "supervisor login" ($supervisor.User.role -eq "regional_supervisor") "regionCode=$($supervisor.User.regionCode)"
Test-Case "manager login" ($manager.User.role -eq "store_manager") "storeId=$($manager.User.storeId)"

$ovDirDefault = Get-Overview $director.Token
Test-Case "director default scope is store" ($ovDirDefault.Data.scope.level -eq "store") "level=$($ovDirDefault.Data.scope.level)"

$ovDirGlobal = Get-Overview $director.Token "scopeLevel=global"
Test-Case "director can use global" ($ovDirGlobal.Ok -and $ovDirGlobal.Data.scope.level -eq "global") "level=$($ovDirGlobal.Data.scope.level)"

$ovSupGlobal = Get-Overview $supervisor.Token "scopeLevel=global"
Test-Case "supervisor blocked from global" (-not $ovSupGlobal.Ok -and $ovSupGlobal.Status -eq 403) "status=$($ovSupGlobal.Status)"

$ovSupRegion = Get-Overview $supervisor.Token "scopeLevel=region"
$regionOk = $ovSupRegion.Ok -and $ovSupRegion.Data.scope.level -eq "region"
Test-Case "supervisor can use region" $regionOk "region=$($ovSupRegion.Data.scope.regionCode)"

$ovSupDefault = Get-Overview $supervisor.Token
Test-Case "supervisor default overview ok" $ovSupDefault.Ok "store=$($ovSupDefault.Data.scope.storeName)"

$ovMgr = Get-Overview $manager.Token
Test-Case "manager store overview" ($ovMgr.Ok -and $ovMgr.Data.scope.level -eq "store") "storeId=$($ovMgr.Data.scope.storeId)"

$ovMgrGlobal = Get-Overview $manager.Token "scopeLevel=global"
Test-Case "manager blocked from global" (-not $ovMgrGlobal.Ok -and $ovMgrGlobal.Status -eq 403) "status=$($ovMgrGlobal.Status)"

$commOk = $false
$commDetail = ""
try {
  $h = @{ Authorization = "Bearer $($director.Token)" }
  $comm = Invoke-RestMethod -Uri "$base/qiwe/communities" -Method GET -Headers $h
  $total = $comm.data.total
  $commOk = $total -gt 0
  $commDetail = "total=$total"
} catch {
  $commDetail = $_.Exception.Message
}
Test-Case "communities list has data" $commOk $commDetail

$fieldOk = $false
$fieldDetail = "no groups"
if ($gMgr.Ok -and $gMgr.Count -gt 0) {
  $g0 = $gMgr.Data.groups[0]
  $fieldOk = ($null -ne $g0.healthGrade) -and ($null -ne $g0.lifecyclePhase)
  $fieldDetail = "grade=$($g0.healthGrade) phase=$($g0.lifecyclePhase)"
}
Test-Case "group has healthGrade and lifecyclePhase" $fieldOk $fieldDetail

$lifeCount = @($ovDirDefault.Data.lifecycleDistribution).Count
Test-Case "overview has lifecycleDistribution" ($lifeCount -gt 0) "count=$lifeCount"

Write-Host ""
Write-Host "=== Summary ==="
$passed = ($results | Where-Object { $_.Pass }).Count
$failed = ($results | Where-Object { -not $_.Pass }).Count
Write-Host "Passed: $passed / $($results.Count), Failed: $failed"
if ($failed -gt 0) {
  $results | Where-Object { -not $_.Pass } | Format-Table -AutoSize
  exit 1
}
exit 0