#!/bin/bash
# 查设备到 Cloudflare API 的连通性 —— 下载登录证书就靠这个。
# 之前失败就是这里超时（error="Failed to fetch resource"）。
set -u

echo "===== api.cloudflare.com 连 5 次 ====="
OK=0
for i in 1 2 3 4 5; do
    OUT=$(timeout 12 curl -4 -s -o /dev/null \
          -w '%{http_code} %{time_total}s' \
          https://api.cloudflare.com/client/v4/user 2>/dev/null)
    CODE=$(echo "$OUT" | cut -d' ' -f1)
    TIME=$(echo "$OUT" | cut -d' ' -f2)
    printf "  第 %d 次: HTTP %-4s  %s\n" "$i" "${CODE:-超时}" "$TIME"
    [ "$CODE" = "200" ] && OK=$((OK + 1))
    sleep 1
done
echo "  成功 $OK / 5 次"

echo
echo "===== 延迟（下载证书用的就是这个链路）====="
timeout 15 curl -4 -s -o /dev/null -w '  握手 %{time_connect}s   首字节 %{time_starttransfer}s   总 %{time_total}s\n' \
    https://api.cloudflare.com/client/v4/user 2>/dev/null || echo "  超时"

echo
echo "===== login.cloudflareaccess.org（回调走这里）====="
timeout 12 curl -4 -s -o /dev/null -w '  HTTP %{http_code}  %{time_total}s\n' \
    https://login.cloudflareaccess.org 2>/dev/null || echo "  超时"

echo
echo "===== DNS 解析 ====="
echo "  api.cloudflare.com:"
getent hosts api.cloudflare.com | head -3 | sed 's/^/    /'
echo "  login.cloudflareaccess.org:"
getent hosts login.cloudflareaccess.org | head -3 | sed 's/^/    /'

echo
echo "===== 当前登录服务状态 ====="
systemctl is-active cf-login.service
tail -3 /root/cf_login.log 2>/dev/null | sed 's/^/  /'