#!/usr/bin/env bash
#
# One command for the HR + Finance e2e suite:
#   build → seed → (Playwright boots the stack) → run → report
#
#   bash e2e-hr-finance/run.sh              # everything
#   bash e2e-hr-finance/run.sh --headed     # watch it
#   bash e2e-hr-finance/run.sh hr           # only specs/hr
#   SKIP_SEED=1 bash e2e-hr-finance/run.sh  # re-run without re-seeding
#
# Requires DB_PASSWORD for the seeders. Everything else has a default.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

export DB_NAME="${DB_NAME:-smart_office_e2e}"
export DB_HOST="${DB_HOST:-localhost}"
export DB_PORT="${DB_PORT:-5432}"
export DB_USER="${DB_USER:-postgres}"

# A checked-in password reaching the production replica would be a real
# incident, not an inconvenience. Refuse early and unmistakably.
if [[ "$DB_NAME" == "smart_office_prod" ]]; then
  echo "refusing to run the e2e suite against smart_office_prod" >&2
  exit 1
fi

if [[ -z "${DB_PASSWORD:-}" ]]; then
  echo "DB_PASSWORD is required (the seeders connect to $DB_NAME)" >&2
  exit 1
fi

echo "==> Building the apps the suite boots"
# Playwright's webServer runs `start` for the APIs (dist/main.js), so they must
# be built first — `dev` would work too but recompiles on every run and races
# the health check.
pnpm turbo build --filter=@edr/hr-api --filter=@edr/finance-api

if [[ "${SKIP_SEED:-}" != "1" ]]; then
  echo "==> Seeding module permissions (idempotent)"
  node scripts/seed-module-permissions.cjs hr
  node scripts/seed-module-permissions.cjs finance

  echo "==> Seeding fixture personas (idempotent)"
  node e2e-hr-finance/fixtures/seed-personas.cjs
fi

echo "==> Running Playwright"
# global-setup mints one storageState per persona; webServer boots the four
# services on their e2e ports (3105/3104/5285/5286) against $DB_NAME.
npx playwright test --config e2e-hr-finance/playwright.config.ts "$@"

echo
echo "==> Report: e2e-hr-finance-report/index.html"
echo "    npx playwright show-report e2e-hr-finance-report"