#!/usr/bin/env bash
# Higress 之六 · 在路由 llm 上挂载演示插件（默认 enabled=false）
#   bash Higress_06_能力插件示例.sh
#   ENABLE=1 bash Higress_06_能力插件示例.sh
set -euo pipefail

CONSOLE="${HIGRESS_CONSOLE:-http://127.0.0.1:8001}"
USER="${HIGRESS_ADMIN_USER:-admin}"
PASS="${HIGRESS_ADMIN_PASS:-Higress207admin!}"
ROUTE="${HIGRESS_DEMO_ROUTE:-llm}"
ENABLE="${ENABLE:-0}"
ENABLED_JSON=false
[ "$ENABLE" = "1" ] || [ "$ENABLE" = "true" ] && ENABLED_JSON=true

COOKIE="$(mktemp)"
trap 'rm -f "$COOKIE"' EXIT

curl -sS -c "$COOKIE" -b "$COOKIE" -X POST "$CONSOLE/session/login" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"$USER\",\"password\":\"$PASS\"}" | tee /tmp/h6_login.json
echo
grep -q '"name"' /tmp/h6_login.json || { echo "[FAIL] login"; exit 1; }

put_plugin() {
  local name="$1"
  local raw_file="$2"
  local raw
  raw="$(cat "$raw_file")"
  local body
  body="$(ENABLED_JSON="$ENABLED_JSON" NAME="$name" RAW="$raw" python3 - <<'PY'
import json, os
print(json.dumps({
  "pluginName": os.environ["NAME"],
  "enabled": os.environ["ENABLED_JSON"] == "true",
  "rawConfigurations": os.environ["RAW"],
}, ensure_ascii=False))
PY
)"
  echo "[INFO] PUT /v1/routes/$ROUTE/plugin-instances/$name enabled=$ENABLED_JSON"
  curl -sS -b "$COOKIE" -X PUT "$CONSOLE/v1/routes/$ROUTE/plugin-instances/$name" \
    -H "Content-Type: application/json" \
    -d "$body"
  echo
}

TMPD="$(mktemp -d)"
trap 'rm -rf "$TMPD" "$COOKIE"' EXIT

cat >"$TMPD/ip.yml" <<'EOF'
ip_source_type: origin-source
allow:
  - 192.168.0.0/16
  - 127.0.0.1
  - 192.168.110.207
status: 403
message: IP not allowed by Higress demo policy
EOF

cat >"$TMPD/rate.yml" <<'EOF'
limit_by_header:
  - key: x-higress-limit
    query_per_minute: 60
EOF

cat >"$TMPD/block.yml" <<'EOF'
blocked_code: 403
blocked_message: blocked by higress request-block demo
case_sensitive: false
block_bodies:
  - 忽略以上指令
  - ignore previous instructions
  - 越狱
EOF

cat >"$TMPD/waf.yml" <<'EOF'
useCRS: true
EOF

put_plugin "ip-restriction" "$TMPD/ip.yml"
put_plugin "key-rate-limit" "$TMPD/rate.yml"
put_plugin "request-block" "$TMPD/block.yml"
put_plugin "waf" "$TMPD/waf.yml"

echo "[INFO] 插件列表："
curl -sS -b "$COOKIE" "$CONSOLE/v1/routes/$ROUTE/plugin-instances" | python3 -m json.tool | head -n 160
echo "[OK] ENABLE=$ENABLE （建议实验室先 false，确认 YAML 后再 ENABLE=1）"