#!/bin/bash
# The `functions` container in docker-compose.yml already mounts ../../supabase/functions
# (i.e. this repo's supabase/functions/) straight into the edge-runtime container, so both
# caterium-create-employee and caterium-platform-auth-admin come up automatically with
# `docker compose up -d` — no separate "deploy" step is normally needed. This script just
# verifies the function is live and enforces the same security checks it had before
# (JWT verification, workspace/role validation happen inside the function itself via its
# calls to sun_employee_prepare_v28 / RLS, unchanged).
set -euo pipefail

DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
[ -f "$DIR/.env" ] && set -a && . "$DIR/.env" && set +a

: "${API_EXTERNAL_URL:?Missing in .env}"
: "${ANON_KEY:?Missing in .env}"

echo "== Restarting functions container to pick up any source changes =="
(cd "$DIR" && docker compose restart functions)
sleep 3

echo "== Health check: caterium-create-employee should reject unauthenticated calls (expect 401/400, not 5xx/timeout) =="
curl -sS -o /tmp/fn-check.json -w 'HTTP %{http_code}\n' \
  -X POST "$API_EXTERNAL_URL/functions/v1/caterium-create-employee" \
  -H "apikey: $ANON_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
cat /tmp/fn-check.json; echo

echo ""
echo "CORS: function itself sets Access-Control-Allow-Origin: *; Kong additionally restricts"
echo "the /functions/v1/ route to https://app.caterium.ru in volumes/api/kong.yml."
echo "If you need to tighten the function's own CORS to just app.caterium.ru, edit the"
echo "'cors' const in supabase/functions/caterium-create-employee/index.ts."