#!/bin/bash
# Windows SSL/网络诊断脚本
# 在 Git Bash 中执行: bash diagnose-windows-ssl.sh

TARGET_URL="https://clauderelay-lb.aihang365.com"
API_ENDPOINT="${TARGET_URL}/openai/responses"

echo "=========================================="
echo "Windows SSL/网络诊断脚本"
echo "=========================================="
echo ""

# 1. 基本信息
echo "1. 系统信息"
echo "   主机名: $(hostname)"
echo "   用户: $(whoami)"
echo "   时间: $(date)"
echo ""

# 2. DNS 解析
echo "2. DNS 解析测试"
DNS_RESULT=$(nslookup clauderelay-lb.aihang365.com 2>&1 | grep -A1 "Name:" | tail -1)
echo "   $DNS_RESULT"
echo ""

# 3. Ping 测试
echo "3. Ping 测试 (2次)"
ping -n 2 clauderelay-lb.aihang365.com 2>&1 | grep -E "Reply|Request|bytes|TTL|time"
echo ""

# 4. 端口连通性
echo "4. 端口连通性 (443)"
timeout 5 bash -c "echo >/dev/tcp/clauderelay-lb.aihang365.com/443" 2>&1 && echo "   端口 443: 可达" || echo "   端口 443: 不可达"
echo ""

# 5. curl 测试 (不验证证书)
echo "5. curl -k 测试 (跳过证书验证)"
CURL_K=$(curl -s -k -w "HTTP: %{http_code}, Time: %{time_total}s" -o /dev/null "${TARGET_URL}/health" 2>&1)
echo "   $CURL_K"
echo ""

# 6. curl 测试 (验证证书)
echo "6. curl 测试 (验证证书)"
CURL_NORMAL=$(curl -s -w "HTTP: %{http_code}, Time: %{time_total}s" -o /dev/null "${TARGET_URL}/health" 2>&1)
if [ $? -eq 0 ]; then
    echo "   成功: $CURL_NORMAL"
else
    echo "   失败: $CURL_NORMAL"
    echo "   详细错误:"
    curl -v "${TARGET_URL}/health" 2>&1 | grep -E "error|SSL|certificate|schannel" | head -5
fi
echo ""

# 7. 证书信息
echo "7. 证书信息"
echo | openssl s_client -connect clauderelay-lb.aihang365.com:443 -servername clauderelay-lb.aihang365.com 2>/dev/null | openssl x509 -noout -dates -issuer 2>/dev/null || echo "   无法获取证书信息"
echo ""

# 8. CRL/OCSP 端点测试
echo "8. CRL/OCSP 端点测试"
# 获取证书的 CRL 和 OCSP URL
CERT_INFO=$(echo | openssl s_client -connect clauderelay-lb.aihang365.com:443 -servername clauderelay-lb.aihang365.com 2>/dev/null | openssl x509 -text 2>/dev/null)
CRL_URL=$(echo "$CERT_INFO" | grep -A2 "CRL Distribution" | grep "URI:" | sed 's/.*URI://' | tr -d ' ')
OCSP_URL=$(echo "$CERT_INFO" | grep -A1 "OCSP" | grep "URI:" | sed 's/.*URI://' | tr -d ' ' | head -1)

if [ -n "$CRL_URL" ]; then
    echo "   CRL URL: $CRL_URL"
    CRL_TEST=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 "$CRL_URL" 2>&1)
    echo "   CRL 访问: HTTP $CRL_TEST"
else
    echo "   CRL URL: 未找到"
fi

if [ -n "$OCSP_URL" ]; then
    echo "   OCSP URL: $OCSP_URL"
    OCSP_TEST=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 "$OCSP_URL" 2>&1)
    echo "   OCSP 访问: HTTP $OCSP_TEST"
else
    echo "   OCSP URL: 未找到"
fi
echo ""

# 9. 注册表检查
echo "9. Windows 证书吊销设置"
REG_HKLM=$(reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation 2>/dev/null | grep -E "0x[0-9]")
REG_HKCU=$(reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v CertificateRevocation 2>/dev/null | grep -E "0x[0-9]")
echo "   HKLM CertificateRevocation: ${REG_HKLM:-未设置}"
echo "   HKCU CertificateRevocation: ${REG_HKCU:-未设置}"
echo ""

# 10. 环境变量
echo "10. 相关环境变量"
echo "    SSL_CERT_FILE: ${SSL_CERT_FILE:-未设置}"
echo "    SSL_CERT_DIR: ${SSL_CERT_DIR:-未设置}"
echo "    CURL_CA_BUNDLE: ${CURL_CA_BUNDLE:-未设置}"
echo "    REQUESTS_CA_BUNDLE: ${REQUESTS_CA_BUNDLE:-未设置}"
echo "    NODE_TLS_REJECT_UNAUTHORIZED: ${NODE_TLS_REJECT_UNAUTHORIZED:-未设置}"
echo ""

# 11. 代理设置
echo "11. 代理设置"
echo "    HTTP_PROXY: ${HTTP_PROXY:-未设置}"
echo "    HTTPS_PROXY: ${HTTPS_PROXY:-未设置}"
echo "    NO_PROXY: ${NO_PROXY:-未设置}"
echo ""

# 12. Codex 配置检查
echo "12. Codex 配置"
CODEX_CONFIG="$HOME/.codex/config.toml"
if [ -f "$CODEX_CONFIG" ]; then
    echo "    配置文件: $CODEX_CONFIG"
    echo "    --- 内容 ---"
    cat "$CODEX_CONFIG" | grep -v "^#" | grep -v "^$" | head -20
else
    echo "    配置文件不存在: $CODEX_CONFIG"
fi
echo ""

# 13. API 端点测试
echo "13. API 端点测试 (跳过SSL)"
API_TEST=$(curl -s -k -X POST "${API_ENDPOINT}" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer test" \
    -d '{"model":"gpt-5-codex","input":"test"}' 2>&1 | head -c 200)
echo "    响应: $API_TEST"
echo ""

echo "=========================================="
echo "诊断完成"
echo "=========================================="
echo ""
echo "如果 curl -k 成功但 curl 失败，问题是证书吊销检查。"
echo "如果 CRL/OCSP 访问失败，需要开放防火墙。"
echo ""
