#!/usr/bin/env bats

load test_helper

setup() {
  global_setup
  dokku nginx:stop
  dokku traefik:set --global letsencrypt-server https://acme-staging-v02.api.letsencrypt.org/directory
  dokku traefik:set --global letsencrypt-email
  dokku traefik:set --global api-enabled
  dokku traefik:set --global api-entry-point
  dokku traefik:set --global api-entry-point-address
  dokku traefik:set --global basic-auth-username
  dokku traefik:set --global basic-auth-password
  dokku traefik:set --global challenge-mode
  dokku traefik:set --global dns-provider
  dokku traefik:start
  create_app
}

teardown() {
  global_teardown
  destroy_app
  dokku traefik:stop
  dokku nginx:start
}

@test "(traefik:report) --global global vs computed log-level" {
  run /bin/bash -c "dokku traefik:report --global --traefik-global-log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output ""

  run /bin/bash -c "dokku traefik:report --global --traefik-computed-log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "ERROR"

  run /bin/bash -c "dokku traefik:set --global log-level DEBUG"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report --global --traefik-global-log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "DEBUG"

  run /bin/bash -c "dokku traefik:report --global --traefik-computed-log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "DEBUG"

  run /bin/bash -c "dokku traefik:set --global log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report --global --traefik-global-log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output ""

  run /bin/bash -c "dokku traefik:report --global --traefik-computed-log-level"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "ERROR"
}

@test "(traefik:report) --global raw and computed keys in --format json" {
  run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-api-vhost\"'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output ""

  run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"computed-api-vhost\"'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "traefik.dokku.me"

  run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-dashboard-enabled\"'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output ""

  run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"computed-dashboard-enabled\"'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "false"
}

@test "(traefik) global-only keys" {
  for key in api-enabled api-entry-point api-entry-point-address api-vhost basic-auth-username basic-auth-password challenge-mode dashboard-enabled dns-provider image letsencrypt-email letsencrypt-server log-level http-entry-point https-entry-point; do
    run /bin/bash -c "dokku traefik:set $TEST_APP $key somevalue"
    echo "key: $key"
    echo "output: $output"
    echo "status: $status"
    assert_failure
    assert_output_contains "can only be set globally"
  done

  run /bin/bash -c "dokku traefik:set $TEST_APP dns-provider-CF_API_TOKEN somevalue"
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "can only be set globally"
}

@test "(traefik) traefik:help" {
  run /bin/bash -c "dokku traefik"
  echo "output: $output"
  echo "status: $status"
  assert_output_contains "Manage the traefik proxy integration"
  help_output="$output"

  run /bin/bash -c "dokku traefik:help"
  echo "output: $output"
  echo "status: $status"
  assert_output_contains "Manage the traefik proxy integration"
  assert_output "$help_output"
}

@test "(traefik) single domain" {
  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "curl --silent $(dokku url $TEST_APP)"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "python/http.server"
}

@test "(traefik) multiple domains" {
  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku domains:add $TEST_APP $TEST_APP.${DOKKU_DOMAIN}"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku domains:add $TEST_APP $TEST_APP-2.${DOKKU_DOMAIN}"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP convert_to_dockerfile
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "curl --silent $TEST_APP.${DOKKU_DOMAIN}"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "python/http.server"

  run /bin/bash -c "curl --silent $TEST_APP-2.${DOKKU_DOMAIN}"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "python/http.server"
}

@test "(traefik) traefik:set api" {
  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect traefik-traefik-1 --format '{{ index .Config.Labels \"traefik.http.routers.api.rule\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_output_not_exists
  assert_success

  run /bin/bash -c "dokku traefik:set --global api-enabled false"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:stop"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:start"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect traefik-traefik-1 --format '{{ index .Config.Labels \"traefik.http.routers.api.rule\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_output_not_exists
  assert_success

  run /bin/bash -c "dokku traefik:set --global api-enabled true"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:stop"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:start"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect traefik-traefik-1 --format '{{ index .Config.Labels \"traefik.http.routers.api.rule\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_output "Host(\`traefik.$DOKKU_DOMAIN\`)"
  assert_success
}

@test "(traefik) ssl" {
  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-http.loadbalancer.server.port\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "5000"

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-https.loadbalancer.server.port\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  run /bin/bash -c "dokku traefik:set --global letsencrypt-email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:stop"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:start"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku ps:inspect $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-http.loadbalancer.server.port\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "5000"

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-https.loadbalancer.server.port\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "5000"

  run /bin/bash -c "dokku ports:report $TEST_APP --ports-map"
  echo "output: $output"
  echo "status: $status"
  assert_output_not_exists

  run /bin/bash -c "dokku ports:report $TEST_APP --ports-map-detected"
  echo "output: $output"
  echo "status: $status"
  assert_output "http:80:5000 https:443:5000"
}

@test "(traefik) show-config without auth set" {
  run /bin/bash -c "dokku traefik:set --global basic-auth-username \"\""
  run /bin/bash -c "dokku traefik:set --global basic-auth-password \"\""

  run /bin/bash -c "dokku traefik:show-config"
  echo "output: $output"
  echo "status: $status"
  assert_success
  refute_line '      - "traefik.http.routers.api.middlewares=auth"'
}

@test "(traefik) show-config with auth set" {
  run /bin/bash -c "dokku traefik:set --global basic-auth-username test-username"
  run /bin/bash -c "dokku traefik:set --global basic-auth-password test-password"

  run /bin/bash -c "dokku traefik:show-config"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_line '      - "traefik.http.routers.api.middlewares=auth"'
}

@test "(traefik) change traefik entry point http" {
  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global http-entry-point web"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.routers.$TEST_APP-web-http.entrypoints\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "web"

}

@test "(traefik) change traefik entry point https" {
  run /bin/bash -c "dokku builder-herokuish:set $TEST_APP allowed true"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global letsencrypt-email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global https-entry-point websecure"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.routers.$TEST_APP-web-https.entrypoints\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "websecure"
}

@test "(traefik) label management" {
  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:labels:add $TEST_APP traefik.directive value"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:labels:show $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "traefik.directive=value"

  run /bin/bash -c "dokku traefik:labels:show $TEST_APP traefik.directive"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "value"

  run /bin/bash -c "dokku traefik:labels:show $TEST_APP traefik.directive2"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  run deploy_app
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.directive\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "value"

  run /bin/bash -c "dokku traefik:labels:remove $TEST_APP traefik.directive"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:labels:show $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_contains "traefik.directive=value"

  run /bin/bash -c "dokku traefik:labels:show $TEST_APP traefik.directive"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  run /bin/bash -c "dokku ps:rebuild $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.directive\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists
}

@test "(traefik) [dns-01] challenge-mode property" {
  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-challenge-mode"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "tls"

  run /bin/bash -c "dokku traefik:set --global challenge-mode dns"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-challenge-mode"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "dns"

  run /bin/bash -c "dokku traefik:set --global challenge-mode"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-challenge-mode"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "tls"
}

@test "(traefik) [dns-01] dns-provider property" {
  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-dns-provider"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  run /bin/bash -c "dokku traefik:set --global dns-provider cloudflare"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-dns-provider"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "cloudflare"

  run /bin/bash -c "dokku traefik:set --global dns-provider"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-dns-provider"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists
}

@test "(traefik) [dns-01] dns-provider-* environment variables" {
  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_key secret-key"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "global dns provider cf_api_email"
  assert_output_contains "global dns provider cf_api_key"
  assert_output_contains "*******" 2
  assert_output_not_contains "test@example.com"
  assert_output_not_contains "secret-key"

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-global-dns-provider-cf_api_email"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "test@example.com"

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-global-dns-provider-cf_api_key"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "secret-key"

  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_email"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_key"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_contains "global dns provider cf_api_email"
  assert_output_not_contains "global dns provider cf_api_key"
}

@test "(traefik) [dns-01] dns-provider-* can only be set globally" {
  run /bin/bash -c "dokku traefik:set $TEST_APP dns-provider-cf_api_email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "can only be set globally"
}

@test "(traefik) [dns-01] challenge-mode can only be set globally" {
  run /bin/bash -c "dokku traefik:set $TEST_APP challenge-mode dns"
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "can only be set globally"
}

@test "(traefik) [dns-01] dns-provider can only be set globally" {
  run /bin/bash -c "dokku traefik:set $TEST_APP dns-provider cloudflare"
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "can only be set globally"
}

@test "(traefik) [dns-01] report json format shows unmasked dns-provider-* values" {
  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_key secret-key"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --format json | jq -r '.\"global-dns-provider-cf_api_email\"'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "test@example.com"

  run /bin/bash -c "dokku traefik:report $TEST_APP --format json | jq -r '.\"global-dns-provider-cf_api_key\"'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "secret-key"

  # Verify stdout format still shows masked values
  run /bin/bash -c "dokku traefik:report $TEST_APP"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "*******" 2
  assert_output_not_contains "test@example.com"
  assert_output_not_contains "secret-key"

  # Cleanup
  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_email"
  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_key"
}

@test "(traefik) [dns-01] show-config with tls challenge" {
  run /bin/bash -c "dokku traefik:set --global letsencrypt-email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.command[] | select(. == \"--certificatesresolvers.leresolver.acme.tlschallenge=true\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "--certificatesresolvers.leresolver.acme.tlschallenge=true"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.command[] | select(contains(\"dnschallenge\"))'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists
}

@test "(traefik) api-entry-point property" {
  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-api-entry-point"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  run /bin/bash -c "dokku traefik:set --global api-entry-point private"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-api-entry-point"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "private"

  run /bin/bash -c "dokku traefik:set --global api-entry-point"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-api-entry-point"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists
}

@test "(traefik) api-entry-point can only be set globally" {
  run /bin/bash -c "dokku traefik:set $TEST_APP api-entry-point private"
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "can only be set globally"
}

@test "(traefik) api-entry-point-address can only be set globally" {
  run /bin/bash -c "dokku traefik:set $TEST_APP api-entry-point-address :8080"
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "can only be set globally"
}

@test "(traefik) show-config with api-entry-point" {
  run /bin/bash -c "dokku traefik:set --global api-enabled true"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global api-entry-point private"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global api-entry-point-address :8080"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.command[] | select(. == \"--entrypoints.private.address=:8080\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "--entrypoints.private.address=:8080"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.labels[] | select(. == \"traefik.http.routers.api.entrypoints=private\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "traefik.http.routers.api.entrypoints=private"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.ports[] | select(. == \":8080:8080\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output ":8080:8080"

  # Cleanup
  run /bin/bash -c "dokku traefik:set --global api-enabled"
  run /bin/bash -c "dokku traefik:set --global api-entry-point"
  run /bin/bash -c "dokku traefik:set --global api-entry-point-address"
}

@test "(traefik) show-config with api-entry-point does not set tls cert resolver" {
  run /bin/bash -c "dokku traefik:set --global letsencrypt-email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global api-enabled true"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global api-entry-point private"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.labels[] | select(contains(\"certresolver\"))'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  # Cleanup
  run /bin/bash -c "dokku traefik:set --global letsencrypt-email"
  run /bin/bash -c "dokku traefik:set --global api-enabled"
  run /bin/bash -c "dokku traefik:set --global api-entry-point"
}

@test "(traefik) [dns-01] show-config with dns challenge" {
  run /bin/bash -c "dokku traefik:set --global letsencrypt-email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global challenge-mode dns"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global dns-provider cloudflare"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_email test@example.com"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_key secret-key"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.command[] | select(. == \"--certificatesresolvers.leresolver.acme.dnschallenge=true\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "--certificatesresolvers.leresolver.acme.dnschallenge=true"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.command[] | select(. == \"--certificatesresolvers.leresolver.acme.dnschallenge.provider=cloudflare\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "--certificatesresolvers.leresolver.acme.dnschallenge.provider=cloudflare"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.environment[] | select(. == \"CF_API_EMAIL=test@example.com\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "CF_API_EMAIL=test@example.com"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.environment[] | select(. == \"CF_API_KEY=secret-key\")'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "CF_API_KEY=secret-key"

  run /bin/bash -c "dokku traefik:show-config | yq -r '.services.traefik.command[] | select(contains(\"tlschallenge\"))'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists

  # Cleanup
  run /bin/bash -c "dokku traefik:set --global challenge-mode"
  run /bin/bash -c "dokku traefik:set --global dns-provider"
  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_email"
  run /bin/bash -c "dokku traefik:set --global dns-provider-cf_api_key"
}

@test "(traefik) healthcheck labels from app.json" {
  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP setup_traefik_healthcheck
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-http.loadbalancer.healthcheck.path\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "/"

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-http.loadbalancer.healthcheck.timeout\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "5s"

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-http.loadbalancer.healthcheck.interval\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output "2s"
}

@test "(traefik) no healthcheck labels without readiness check" {
  run /bin/bash -c "dokku proxy:set $TEST_APP traefik"
  echo "output: $output"
  echo "status: $status"
  assert_success

  run deploy_app python dokku@$DOKKU_DOMAIN:$TEST_APP
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "docker inspect $TEST_APP.web.1 --format '{{ index .Config.Labels \"traefik.http.services.$TEST_APP-web-http.loadbalancer.healthcheck.path\" }}'"
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_not_exists
}

setup_traefik_healthcheck() {
  local APP="$1"
  local APP_REPO_DIR="$2"
  [[ -z "$APP" ]] && local APP="$TEST_APP"
  APP_REPO_DIR="$(realpath "$APP_REPO_DIR")"

  mv "$APP_REPO_DIR/app-traefik.json" "$APP_REPO_DIR/app.json"
}