#!/bin/bash

# Docker和GitHub连接验证脚本
# 用于测试是否能通过WireGuard正常访问Docker Hub和GitHub

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

print_status() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[✓]${NC} $1"
}

print_error() {
    echo -e "${RED}[✗]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[!]${NC} $1"
}

# 测试计数器
PASSED=0
FAILED=0
WARNING=0

# 检查WireGuard状态
check_wg_status() {
    echo "=================================================="
    print_status "1. 检查WireGuard隧道状态"
    echo "=================================================="
    
    if sudo wg show wg0 &>/dev/null; then
        print_success "WireGuard接口wg0正在运行"
        
        # 显示详细信息
        WG_INFO=$(sudo wg show wg0)
        echo "$WG_INFO" | grep -E "interface|peer|endpoint|latest handshake|transfer" | while read line; do
            print_status "  $line"
        done
        
        ((PASSED++))
        echo ""
        return 0
    else
        print_error "WireGuard接口wg0未运行"
        print_warning "请先运行: ./setup_wireguard.sh"
        ((FAILED++))
        echo ""
        return 1
    fi
}

# 检查路由表
check_routes() {
    echo "=================================================="
    print_status "2. 检查网络路由"
    echo "=================================================="
    
    # 检查默认路由
    DEFAULT_ROUTE=$(netstat -rn | grep "^default" | head -1)
    print_status "默认路由: $DEFAULT_ROUTE"
    
    # 检查WireGuard路由
    WG_ROUTES=$(netstat -rn | grep wg0 | head -5)
    if [ -n "$WG_ROUTES" ]; then
        print_success "WireGuard路由已配置"
        echo "$WG_ROUTES" | while read line; do
            print_status "  $line"
        done
        ((PASSED++))
    else
        print_warning "未找到WireGuard路由"
        ((WARNING++))
    fi
    echo ""
}

# 检查DNS解析
check_dns() {
    echo "=================================================="
    print_status "3. 检查DNS解析"
    echo "=================================================="
    
    # 检查GitHub解析
    print_status "解析 github.com..."
    GITHUB_IP=$(dig +short github.com @223.5.5.5 | head -1)
    if [ -n "$GITHUB_IP" ]; then
        print_success "GitHub DNS解析成功: $GITHUB_IP"
        ((PASSED++))
    else
        print_error "GitHub DNS解析失败"
        ((FAILED++))
    fi
    
    # 检查Docker Hub解析
    print_status "解析 registry-1.docker.io..."
    DOCKER_IP=$(dig +short registry-1.docker.io @223.5.5.5 | head -1)
    if [ -n "$DOCKER_IP" ]; then
        print_success "Docker Hub DNS解析成功: $DOCKER_IP"
        ((PASSED++))
    else
        print_error "Docker Hub DNS解析失败"
        ((FAILED++))
    fi
    echo ""
}

# 测试GitHub连接
test_github_connectivity() {
    echo "=================================================="
    print_status "4. 测试GitHub连接"
    echo "=================================================="
    
    # 测试HTTPS连接
    print_status "测试GitHub HTTPS (github.com)..."
    if curl -I -s --connect-timeout 10 --max-time 15 https://github.com 2>&1 | head -1 | grep -q "200\|301\|302"; then
        print_success "GitHub HTTPS连接正常"
        ((PASSED++))
    else
        print_error "GitHub HTTPS连接失败"
        ((FAILED++))
    fi
    
    # 测试API连接
    print_status "测试GitHub API (api.github.com)..."
    API_RESPONSE=$(curl -s --connect-timeout 10 --max-time 15 https://api.github.com/zen 2>/dev/null || echo "failed")
    if [ "$API_RESPONSE" != "failed" ] && [ -n "$API_RESPONSE" ]; then
        print_success "GitHub API连接正常: $API_RESPONSE"
        ((PASSED++))
    else
        print_error "GitHub API连接失败"
        ((FAILED++))
    fi
    
    # 测试SSH连接
    print_status "测试GitHub SSH (git@github.com)..."
    SSH_TEST=$(timeout 10 ssh -T -o StrictHostKeyChecking=no -o ConnectTimeout=10 git@github.com 2>&1 || true)
    if echo "$SSH_TEST" | grep -q "successfully authenticated"; then
        print_success "GitHub SSH认证成功"
        ((PASSED++))
    elif echo "$SSH_TEST" | grep -q "Permission denied"; then
        print_warning "GitHub SSH连接成功但未配置密钥（正常）"
        ((WARNING++))
    else
        print_warning "GitHub SSH连接测试失败（如无SSH密钥则正常）"
        ((WARNING++))
    fi
    
    # 测试Git克隆速度
    print_status "测试Git克隆速度..."
    TMP_DIR="/tmp/git_speed_test_$$"
    START_TIME=$(date +%s)
    
    if timeout 60 git clone --depth 1 https://github.com/github/gitignore.git "$TMP_DIR" &>/dev/null; then
        END_TIME=$(date +%s)
        DURATION=$((END_TIME - START_TIME))
        print_success "Git克隆成功，耗时: ${DURATION}秒"
        rm -rf "$TMP_DIR"
        ((PASSED++))
    else
        print_error "Git克隆失败或超时"
        rm -rf "$TMP_DIR" 2>/dev/null || true
        ((FAILED++))
    fi
    echo ""
}

# 测试Docker连接
test_docker_connectivity() {
    echo "=================================================="
    print_status "5. 测试Docker连接"
    echo "=================================================="
    
    if ! command -v docker &>/dev/null; then
        print_warning "Docker未安装，跳过Docker测试"
        ((WARNING++))
        echo ""
        return 0
    fi
    
    # 检查Docker运行状态
    print_status "检查Docker守护进程..."
    if docker info &>/dev/null; then
        print_success "Docker守护进程运行正常"
        ((PASSED++))
    else
        print_error "Docker守护进程未运行"
        print_warning "请启动Docker Desktop"
        ((FAILED++))
        echo ""
        return 1
    fi
    
    # 测试Docker Hub连接
    print_status "测试Docker Hub连接 (拉取alpine镜像)..."
    START_TIME=$(date +%s)
    
    if timeout 120 docker pull alpine:latest 2>&1 | grep -q "Downloaded\|Image is up to date\|Status: Downloaded newer image"; then
        END_TIME=$(date +%s)
        DURATION=$((END_TIME - START_TIME))
        print_success "Docker Hub连接正常，耗时: ${DURATION}秒"
        ((PASSED++))
        
        # 清理测试镜像
        docker rmi alpine:latest &>/dev/null || true
    else
        print_error "Docker Hub连接失败或超时"
        ((FAILED++))
    fi
    
    # 测试其他镜像仓库
    print_status "测试其他镜像仓库 (hello-world)..."
    if timeout 60 docker pull hello-world:latest &>/dev/null; then
        print_success "镜像仓库连接正常"
        docker rmi hello-world:latest &>/dev/null || true
        ((PASSED++))
    else
        print_warning "镜像仓库连接较慢或失败"
        ((WARNING++))
    fi
    echo ""
}

# 测试出口IP
test_exit_ip() {
    echo "=================================================="
    print_status "6. 检查出口IP地址"
    echo "=================================================="
    
    print_status "检测当前出口IP (IPv4)..."
    EXIT_IP=$(curl -s --max-time 10 https://api.ipify.org 2>/dev/null || echo "检测失败")
    if [ "$EXIT_IP" != "检测失败" ]; then
        print_success "出口IP (IPv4): $EXIT_IP"
        ((PASSED++))
    else
        print_error "无法检测出口IP"
        ((FAILED++))
    fi
    
    print_status "检测当前出口IP (IPv6)..."
    EXIT_IP_V6=$(curl -s --max-time 10 https://api64.ipify.org 2>/dev/null || echo "检测失败")
    if [ "$EXIT_IP_V6" != "检测失败" ]; then
        print_success "出口IP (IPv6): $EXIT_IP_V6"
        ((PASSED++))
    else
        print_warning "无法检测IPv6出口IP（可能未启用IPv6）"
        ((WARNING++))
    fi
    
    # 检测位置
    print_status "检测IP地理位置..."
    LOCATION=$(curl -s --max-time 10 "https://ipapi.co/$EXIT_IP/json/" 2>/dev/null | grep -o '"country_name":"[^"]*' | cut -d'"' -f4 || echo "未知")
    if [ "$LOCATION" != "未知" ] && [ -n "$LOCATION" ]; then
        print_success "位置: $LOCATION"
    else
        print_status "位置: 未知"
    fi
    echo ""
}

# 生成报告
generate_report() {
    echo "=================================================="
    echo "              测试结果汇总"
    echo "=================================================="
    echo ""
    print_success "通过测试: $PASSED"
    print_warning "警告项目: $WARNING"
    print_error "失败测试: $FAILED"
    echo ""
    
    TOTAL=$((PASSED + FAILED + WARNING))
    if [ $TOTAL -gt 0 ]; then
        SUCCESS_RATE=$((PASSED * 100 / TOTAL))
        print_status "成功率: ${SUCCESS_RATE}%"
    fi
    echo ""
    
    if [ $FAILED -eq 0 ]; then
        print_success "所有关键测试通过！Docker和GitHub可以通过WireGuard正常访问。"
        echo ""
        print_status "建议："
        echo "  - 定期运行此脚本检查连接状态"
        echo "  - 如遇到问题，可运行 ./check-tunnel.sh 进行详细诊断"
    else
        print_error "部分测试失败，请检查配置。"
        echo ""
        print_status "故障排查步骤："
        echo "  1. 确保WireGuard运行: sudo wg show wg0"
        echo "  2. 检查路由配置: netstat -rn | grep wg0"
        echo "  3. 重启WireGuard: ./stop_wireguard.sh && ./setup_wireguard.sh"
        echo "  4. 如果是Docker问题，重启Docker Desktop"
        echo "  5. 运行完整诊断: ./check-tunnel.sh"
    fi
    echo ""
    echo "=================================================="
}

# 主函数
main() {
    echo ""
    echo "=================================================="
    echo "   Docker和GitHub WireGuard连接验证"
    echo "=================================================="
    echo ""
    
    check_wg_status || exit 1
    check_routes
    check_dns
    test_exit_ip
    test_github_connectivity
    test_docker_connectivity
    generate_report
}

main "$@"