#!/usr/bin/env bash
# =============================================================================
# Twosome – Unified Match Engine Smoke & Integration Test Suite
# Tests: Tic-Tac-Toe, Rock-Paper-Scissors (hidden information isolation),
#        Move validation, Idempotency, Cheap polling, Forfeit, Rematch, Scoreboard.
# Usage: ./match_test.sh [API_BASE_URL]
# Default: http://localhost:8000
# =============================================================================

set -euo pipefail

BASE_URL="${1:-http://localhost:8000}"
echo "=========================================================="
echo " Twosome Match Engine Test Suite"
echo " Target: ${BASE_URL}"
echo "=========================================================="

pass() {
  echo -e "\033[32m[PASS]\033[0m $1"
}

fail() {
  echo -e "\033[31m[FAIL]\033[0m $1"
  if [ -n "${2:-}" ]; then
    echo "Detail: $2"
  fi
  exit 1
}

# 1. Health check
echo -n "1. Checking GET /v1/health... "
HEALTH_RESP=$(curl -s "${BASE_URL}/v1/health")
echo "${HEALTH_RESP}" | grep -q '"status":"ok"' && pass "API is online" || fail "Health check failed" "${HEALTH_RESP}"

# 2. Register User A and User B
RAND_SUFFIX=$((100000 + RANDOM % 900000))
PHONE_A="+919777${RAND_SUFFIX}"
PHONE_B="+919666${RAND_SUFFIX}"
PASSWORD="StrongSecretPass99#"

echo "Registering test users (${PHONE_A} & ${PHONE_B})..."
REG_A=$(curl -s -X POST "${BASE_URL}/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d "{\"phone_e164\":\"${PHONE_A}\",\"password\":\"${PASSWORD}\",\"display_name\":\"Player A\",\"birth_year\":1998}")
TOKEN_A=$(echo "${REG_A}" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
USER_A_ID=$(echo "${REG_A}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

REG_B=$(curl -s -X POST "${BASE_URL}/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d "{\"phone_e164\":\"${PHONE_B}\",\"password\":\"${PASSWORD}\",\"display_name\":\"Player B\",\"birth_year\":1999}")
TOKEN_B=$(echo "${REG_B}" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
USER_B_ID=$(echo "${REG_B}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

[ -n "${TOKEN_A}" ] && [ -n "${TOKEN_B}" ] && pass "Users registered (ID A: ${USER_A_ID}, ID B: ${USER_B_ID})" || fail "Registration failed"

# 3. Couple Pairing
echo "Pairing users into couple..."
COUPLE_CREATE=$(curl -s -X POST "${BASE_URL}/v1/couple" \
  -H "Authorization: Bearer ${TOKEN_A}")
INVITE_CODE=$(echo "${COUPLE_CREATE}" | grep -o '"invite_code":"[^"]*' | cut -d'"' -f4)

COUPLE_JOIN=$(curl -s -X POST "${BASE_URL}/v1/couple/join" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d "{\"invite_code\":\"${INVITE_CODE}\"}")
echo "${COUPLE_JOIN}" | grep -q '"linked":true' && pass "Couple successfully paired" || fail "Couple join failed" "${COUPLE_JOIN}"

# 4. List matches when empty
echo -n "4. Listing matches (initial empty state)... "
LIST_INITIAL=$(curl -s -X GET "${BASE_URL}/v1/matches" -H "Authorization: Bearer ${TOKEN_A}")
echo "${LIST_INITIAL}" | grep -q '"matches":\[' && pass "Empty matches array returned" || fail "List matches failed" "${LIST_INITIAL}"

# 5. Tic-Tac-Toe Match: Creation, Turns, Idempotency, Out-of-turn rejection, Win
echo "5. Testing Tic-Tac-Toe..."
MATCH_CREATE=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"tic_tac_toe","play_mode":"async","relationship_mode":"apart","stake":"random"}')

MATCH_ID=$(echo "${MATCH_CREATE}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)
echo "${MATCH_CREATE}" | grep -q '"server_time"' && pass "Match created with server_time clock-drift info (Match ID: ${MATCH_ID})" || fail "Match creation failed" "${MATCH_CREATE}"

# 5a. Out-of-turn move rejection: User B tries to move first
echo -n "   Testing out-of-turn rejection (User B moving first)... "
OUT_OF_TURN=$(curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"move-b-illegal-1","move":{"position":0}}')
echo "${OUT_OF_TURN}" | grep -q 'NOT_YOUR_TURN' && pass "Out-of-turn rejected with NOT_YOUR_TURN" || fail "Out-of-turn not rejected" "${OUT_OF_TURN}"

# 5b. User A makes valid move 0
CLIENT_MOVE_A1="move-a-pos-0-${RANDOM}"
MOVE_A1=$(curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"${CLIENT_MOVE_A1}\",\"move\":{\"position\":0}}")
echo "${MOVE_A1}" | grep -q '"version":2' && pass "User A played position 0, version incremented" || fail "User A move failed" "${MOVE_A1}"

# 5c. Idempotency test: User A submits same client_move_id again
echo -n "   Testing idempotency replay on duplicate client_move_id... "
MOVE_A1_DUP=$(curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"${CLIENT_MOVE_A1}\",\"move\":{\"position\":0}}")
echo "${MOVE_A1_DUP}" | grep -q '"idempotent_replayed":true' && pass "Duplicate client_move_id safely replayed idempotently" || fail "Idempotency failed" "${MOVE_A1_DUP}"

# 5d. User B plays pos 3
curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"b-pos-3-${RANDOM}\",\"move\":{\"position\":3}}" > /dev/null

# 5e. User A plays pos 1
curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"a-pos-1-${RANDOM}\",\"move\":{\"position\":1}}" > /dev/null

# 5f. User B plays pos 4
curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"b-pos-4-${RANDOM}\",\"move\":{\"position\":4}}" > /dev/null

# 5g. User A plays pos 2 -> completes line [0, 1, 2] and wins!
FINAL_MOVE=$(curl -s -X POST "${BASE_URL}/v1/matches/${MATCH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"a-pos-2-${RANDOM}\",\"move\":{\"position\":2}}")

echo "${FINAL_MOVE}" | grep -q '"is_finished":true' && pass "User A completed winning line [0, 1, 2], match finished" || fail "Winning move failed" "${FINAL_MOVE}"
echo "${FINAL_MOVE}" | grep -q '"winner_id":'"${USER_A_ID}" && pass "Winner verified as User A (${USER_A_ID})" || fail "Winner incorrect" "${FINAL_MOVE}"
echo "${FINAL_MOVE}" | grep -q 'forfeit_assigned' && pass "Loser forfeit stake assigned automatically" || fail "Stake resolution failed" "${FINAL_MOVE}"

# 6. Cheap Polling with ?since_version=N
echo -n "6. Testing cheap polling (?since_version=N)... "
POLL_SAME=$(curl -s -X GET "${BASE_URL}/v1/matches/${MATCH_ID}?since_version=6" \
  -H "Authorization: Bearer ${TOKEN_A}")
echo "${POLL_SAME}" | grep -q '"unchanged":true' && pass "Cheap polling returned unchanged:true with zero payload overhead" || fail "Polling failed" "${POLL_SAME}"

POLL_DIFF=$(curl -s -X GET "${BASE_URL}/v1/matches/${MATCH_ID}?since_version=1" \
  -H "Authorization: Bearer ${TOKEN_A}")
echo "${POLL_DIFF}" | grep -q '"unchanged":false' && pass "Polling with older version returned full updated match object" || fail "Polling update failed" "${POLL_DIFF}"

# 7. Rock-Paper-Scissors: Hidden Information Security
echo "7. Testing Rock-Paper-Scissors & Hidden Information Isolation..."
RPS_CREATE=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"rock_paper_scissors","rounds":1,"relationship_mode":"apart"}')
RPS_ID=$(echo "${RPS_CREATE}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# User A submits pick "rock"
curl -s -X POST "${BASE_URL}/v1/matches/${RPS_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"rps-pick-a-${RANDOM}\",\"move\":{\"choice\":\"rock\"}}" > /dev/null

# CRITICAL SECURITY CHECK: Partner checks match state. Opponent's secret pick MUST NOT be exposed!
echo -n "   Checking opponent pick isolation in partner state... "
PARTNER_VIEW=$(curl -s -X GET "${BASE_URL}/v1/matches/${RPS_ID}" \
  -H "Authorization: Bearer ${TOKEN_B}")

echo "${PARTNER_VIEW}" | grep -q '"opponent_has_picked":true' || fail "opponent_has_picked flag missing" "${PARTNER_VIEW}"
# The string "rock" must NOT appear in PARTNER_VIEW because it is secret pending information!
if echo "${PARTNER_VIEW}" | grep -q '"rock"'; then
  fail "SECURITY VIOLATION: Opponent's secret pick 'rock' leaked over the wire before mutual reveal!" "${PARTNER_VIEW}"
fi
pass "ZERO INFORMATION LEAK: Opponent pick is hidden on server; partner only sees opponent_has_picked:true"

# User B submits pick "scissors" -> Rock beats Scissors
RPS_FINISH=$(curl -s -X POST "${BASE_URL}/v1/matches/${RPS_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"rps-pick-b-${RANDOM}\",\"move\":{\"choice\":\"scissors\"}}")
echo "${RPS_FINISH}" | grep -q '"is_finished":true' && pass "Mutual reveal resolved round: Rock beats Scissors" || fail "RPS finish failed" "${RPS_FINISH}"

# 8. Scoreboard Verification
echo -n "8. Checking GET /v1/scoreboard... "
SCOREBOARD=$(curl -s -X GET "${BASE_URL}/v1/scoreboard" \
  -H "Authorization: Bearer ${TOKEN_A}")
echo "${SCOREBOARD}" | grep -q '"per_game"' && echo "${SCOREBOARD}" | grep -q '"team_score"' && pass "Scoreboard returned per-game, overall, streaks, and team_score" || fail "Scoreboard format invalid" "${SCOREBOARD}"

# 9. Match Forfeit
echo -n "9. Testing match forfeit... "
FORFEIT_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"tic_tac_toe","play_mode":"async"}')
FORFEIT_ID=$(echo "${FORFEIT_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

FORFEIT_RESP=$(curl -s -X POST "${BASE_URL}/v1/matches/${FORFEIT_ID}/forfeit" \
  -H "Authorization: Bearer ${TOKEN_A}")
echo "${FORFEIT_RESP}" | grep -q '"forfeited":true' && echo "${FORFEIT_RESP}" | grep -q '"winner_id":'"${USER_B_ID}" && pass "User A forfeit granted victory to User B" || fail "Forfeit failed" "${FORFEIT_RESP}"

# 10. Rematch
echo -n "10. Testing /rematch endpoint... "
REMATCH_RESP=$(curl -s -X POST "${BASE_URL}/v1/matches/${FORFEIT_ID}/rematch" \
  -H "Authorization: Bearer ${TOKEN_B}")
echo "${REMATCH_RESP}" | grep -q '"rematch":true' && pass "Rematch successfully created new game with preserved configuration" || fail "Rematch failed" "${REMATCH_RESP}"

# 11. Active Matches List & Turn Badges
echo -n "11. Testing GET /v1/matches?status=active for turn badges... "
BADGES_RESP=$(curl -s -X GET "${BASE_URL}/v1/matches?status=active" \
  -H "Authorization: Bearer ${TOKEN_B}")
echo "${BADGES_RESP}" | grep -q '"my_turn_count"' && pass "Active matches list includes is_my_turn and my_turn_count for UI badges" || fail "Badges check failed" "${BADGES_RESP}"

# 12. Connect Four: Creation & 4-in-a-row Win Detection
echo "12. Testing Connect Four (7x6)..."
C4_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"connect_four","play_mode":"async"}')
C4_ID=$(echo "${C4_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# Col 0: A, Col 1: B, Col 0: A, Col 1: B, Col 0: A, Col 1: B, Col 0: A -> A wins vertical 4-in-a-row!
curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_A}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-a1","move":{"col":0}}' > /dev/null
curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_B}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-b1","move":{"col":1}}' > /dev/null
curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_A}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-a2","move":{"col":0}}' > /dev/null
curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_B}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-b2","move":{"col":1}}' > /dev/null
curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_A}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-a3","move":{"col":0}}' > /dev/null
curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_B}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-b3","move":{"col":1}}' > /dev/null
C4_WIN=$(curl -s -X POST "${BASE_URL}/v1/matches/${C4_ID}/move" -H "Authorization: Bearer ${TOKEN_A}" -H "Content-Type: application/json" -d '{"client_move_id":"c4-a4","move":{"col":0}}')

echo "${C4_WIN}" | grep -q '"is_finished":true' && echo "${C4_WIN}" | grep -q '"winner_id":'"${USER_A_ID}" && pass "Connect Four 4-in-a-row vertical win detected" || fail "Connect Four win failed" "${C4_WIN}"

# 13. Love Battleship: Secret Fleet Placement & Zero Leakage Security Guarantee
echo "13. Testing Love Battleship & Secret Fleet Security..."
BS_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"love_battleship","play_mode":"async"}')
BS_ID=$(echo "${BS_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# User A places fleet
PLACE_A_PAYLOAD='{"action":"place_fleet","ships":[{"id":"cupid_dinghy","cells":[[0,0],[0,1]]},{"id":"love_tug","cells":[[1,0],[1,1],[1,2]]},{"id":"romance_cruiser","cells":[[2,0],[2,1],[2,2]]},{"id":"heart_destroyer","cells":[[3,0],[3,1],[3,2],[3,3]]},{"id":"passion_flagship","cells":[[4,0],[4,1],[4,2],[4,3],[4,4]]}]}'
curl -s -X POST "${BASE_URL}/v1/matches/${BS_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"bs-place-a\",\"move\":${PLACE_A_PAYLOAD}}" > /dev/null

# CRITICAL PROOF: User B queries match state before placing their own fleet
echo -n "   Proving User B CANNOT see User A fleet coordinates... "
VIEW_B_BEFORE=$(curl -s -X GET "${BASE_URL}/v1/matches/${BS_ID}" -H "Authorization: Bearer ${TOKEN_B}")
if echo "${VIEW_B_BEFORE}" | grep -q 'passion_flagship'; then
  fail "SECURITY VIOLATION: Opponent ship IDs or coordinates leaked to partner before battle!" "${VIEW_B_BEFORE}"
fi
echo "${VIEW_B_BEFORE}" | grep -q '"opponent_has_placed":true' && pass "Opponent fleet is completely masked on server (only opponent_has_placed:true visible)"

# User B places fleet
PLACE_B_PAYLOAD='{"action":"place_fleet","ships":[{"id":"cupid_dinghy","cells":[[0,0],[0,1]]},{"id":"love_tug","cells":[[1,0],[1,1],[1,2]]},{"id":"romance_cruiser","cells":[[2,0],[2,1],[2,2]]},{"id":"heart_destroyer","cells":[[3,0],[3,1],[3,2],[3,3]]},{"id":"passion_flagship","cells":[[4,0],[4,1],[4,2],[4,3],[4,4]]}]}'
curl -s -X POST "${BASE_URL}/v1/matches/${BS_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d "{\"client_move_id\":\"bs-place-b\",\"move\":${PLACE_B_PAYLOAD}}" > /dev/null

# Phase transitioned to battle
VIEW_A_BATTLE=$(curl -s -X GET "${BASE_URL}/v1/matches/${BS_ID}" -H "Authorization: Bearer ${TOKEN_A}")
echo "${VIEW_A_BATTLE}" | grep -q '"phase":"battle"' && pass "Both fleets placed, transitioned to battle phase" || fail "Battle transition failed" "${VIEW_A_BATTLE}"

# User A fires shot at [0,0] -> HIT
FIRE_HIT=$(curl -s -X POST "${BASE_URL}/v1/matches/${BS_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"bs-fire-1","move":{"action":"fire","row":0,"col":0}}')
echo "${FIRE_HIT}" | grep -q '"result":"hit"' && pass "Shot at [0,0] correctly reported 'hit'" || fail "Hit report failed" "${FIRE_HIT}"

# User A fires shot at [0,1] -> SUNK cupid_dinghy!
FIRE_SUNK=$(curl -s -X POST "${BASE_URL}/v1/matches/${BS_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"bs-fire-2","move":{"action":"fire","row":0,"col":1}}')
echo "${FIRE_SUNK}" | grep -q '"sunk":true' && pass "Shot at [0,1] sank Cupid's Dinghy" || fail "Sunk report failed" "${FIRE_SUNK}"

# PROOF: Even after sinking one boat, remaining opponent ships remain hidden!
VIEW_A_MIDGAME=$(curl -s -X GET "${BASE_URL}/v1/matches/${BS_ID}" -H "Authorization: Bearer ${TOKEN_A}")
if echo "${VIEW_A_MIDGAME}" | grep -q 'passion_flagship'; then
  fail "SECURITY VIOLATION: Unsunk opponent ships leaked to attacker!" "${VIEW_A_MIDGAME}"
fi
pass "ZERO LEAK VERIFIED: Unsunk opponent ship positions remain strictly server-side!"

# 14. Memory Match: Emoji Masking Security
echo "14. Testing Memory Match Emoji Masking Security..."
MM_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"memory_match","play_mode":"async"}')
MM_ID=$(echo "${MM_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

MM_VIEW=$(curl -s -X GET "${BASE_URL}/v1/matches/${MM_ID}" -H "Authorization: Bearer ${TOKEN_A}")
# Count occurrences of '"emoji":null' vs actual emojis
NULL_EMOJI_COUNT=$(echo "${MM_VIEW}" | grep -o '"emoji":null' | wc -l)
if [ "${NULL_EMOJI_COUNT}" -ne 16 ]; then
  fail "SECURITY VIOLATION: Memory Match cards must all have emoji:null before flips!" "${MM_VIEW}"
fi
pass "ZERO LEAK VERIFIED: All 16 cards have emoji:null over the wire before being flipped"

# Flip card 0
MM_FLIP1=$(curl -s -X POST "${BASE_URL}/v1/matches/${MM_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"mm-flip-1","move":{"card_index":0}}')
echo "${MM_FLIP1}" | grep -q '"flipped_card_1":0' && pass "Card 0 flipped successfully" || fail "Card flip failed" "${MM_FLIP1}"

# 15. Nim (Last Heart Standing)
echo "15. Testing Nim (Last Heart Standing)..."
NIM_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"nim","play_mode":"async"}')
NIM_ID=$(echo "${NIM_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# User A takes 2 from pile 0 (3 -> 1)
NIM_MOVE1=$(curl -s -X POST "${BASE_URL}/v1/matches/${NIM_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"nim-1","move":{"pile":0,"count":2}}')
echo "${NIM_MOVE1}" | grep -q '"piles":\[1,5,7\]' && pass "Nim move deducted hearts from pile 0" || fail "Nim move failed" "${NIM_MOVE1}"

# 16. Dice Duel (Push Your Luck)
echo "16. Testing Dice Duel (Push Your Luck)..."
DD_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"dice_duel","play_mode":"async"}')
DD_ID=$(echo "${DD_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# User A rolls die
DD_ROLL=$(curl -s -X POST "${BASE_URL}/v1/matches/${DD_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"dd-roll-1","move":{"action":"roll"}}')
echo "${DD_ROLL}" | grep -q '"last_roll"' && pass "Server generated secure seeded roll" || fail "Dice Duel roll failed" "${DD_ROLL}"

# 17. Liar's Dice: Hidden Dice Isolation Proof & Challenge
echo "17. Testing Liar's Dice & Hidden Hand Security..."
LD_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"liars_dice","play_mode":"async"}')
LD_ID=$(echo "${LD_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# User A queries match: opponent_dice MUST BE null
echo -n "   Proving User A cannot see User B's secret dice... "
LD_VIEW_A=$(curl -s -X GET "${BASE_URL}/v1/matches/${LD_ID}" -H "Authorization: Bearer ${TOKEN_A}")
echo "${LD_VIEW_A}" | grep -q '"opponent_dice":null' || fail "Opponent dice leaked in API response" "${LD_VIEW_A}"
pass "ZERO INFORMATION LEAK: Opponent dice are strictly null during bidding"

# User A places opening bid
LD_BID1=$(curl -s -X POST "${BASE_URL}/v1/matches/${LD_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"ld-bid-1","move":{"action":"bid","quantity":1,"face":2}}')
echo "${LD_BID1}" | grep -q '"current_bid"' && pass "Opening bid of 1 two placed successfully" || fail "Bid failed" "${LD_BID1}"

# User B challenges: calls Liar!
LD_CHALLENGE=$(curl -s -X POST "${BASE_URL}/v1/matches/${LD_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_B}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"ld-chal-1","move":{"action":"challenge"}}')
echo "${LD_CHALLENGE}" | grep -q '"phase":"revealed"' && echo "${LD_CHALLENGE}" | grep -q '"actual_count"' && pass "Liar challenge revealed hands and evaluated actual dice count" || fail "Challenge failed" "${LD_CHALLENGE}"

# 18. Number Hunter: Secret Number Masking & Hotter/Colder Hints
echo "18. Testing Number Hunter & Secret Number Masking..."
NH_MATCH=$(curl -s -X POST "${BASE_URL}/v1/matches" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"game_type":"number_hunter","play_mode":"async"}')
NH_ID=$(echo "${NH_MATCH}" | grep -o '"id":[0-9]*' | head -n1 | cut -d':' -f2)

# User A queries match: secret_number MUST BE null
echo -n "   Proving secret target 1-100 is NOT leaked to players... "
NH_VIEW_A=$(curl -s -X GET "${BASE_URL}/v1/matches/${NH_ID}" -H "Authorization: Bearer ${TOKEN_A}")
echo "${NH_VIEW_A}" | grep -q '"secret_number":null' || fail "Secret number leaked in API response" "${NH_VIEW_A}"
pass "ZERO INFORMATION LEAK: Secret number is strictly null in active API responses"

# User A submits guess of 50
NH_GUESS1=$(curl -s -X POST "${BASE_URL}/v1/matches/${NH_ID}/move" \
  -H "Authorization: Bearer ${TOKEN_A}" \
  -H "Content-Type: application/json" \
  -d '{"client_move_id":"nh-guess-1","move":{"action":"guess","guess":50}}')
echo "${NH_GUESS1}" | grep -q '"direction"' && echo "${NH_GUESS1}" | grep -q '"temp_hint"' && pass "Guess evaluated with directional and hotter/colder hints" || fail "Guess evaluation failed" "${NH_GUESS1}"

echo "=========================================================="
echo -e "\033[32mALL 18 MATCH ENGINE INTEGRATION TESTS PASSED!\033[0m"
echo "=========================================================="