#!/usr/bin/env node

const assert = require("assert");
const fs = require("fs");
const path = require("path");

const repo = path.resolve(__dirname, "..");
const infraRepo = path.resolve(repo, "..", "michelpaulissen.com");

function read(relativePath, base = repo) {
  return fs.readFileSync(path.join(base, relativePath), "utf8");
}

function expect(source, name, pattern) {
  assert.match(source, pattern, `missing public browser login evidence: ${name}`);
}

const cliSource = [
  read("crates/disasmer-cli/src/main.rs"),
  read("crates/disasmer-cli/src/dispatch.rs"),
  read("crates/disasmer-cli/src/auth.rs"),
].join("\n");
const cliSmoke = read("scripts/cli-browser-login-flow-smoke.js");
const publicAcceptance = read("scripts/acceptance-public.sh");
const phase2 = read("acceptance_criteria_phase2.md");
const base = read("acceptance_criteria.md");

for (const [name, source] of [
  ["base acceptance", base],
  ["phase 2 acceptance", phase2],
]) {
  expect(source, `${name} released binary browser criterion`, /Public released binaries[\s\S]*(?:human |server-owned )browser\/account flow/);
}

expect(cliSource, "diagnostic plan flag", /plan: bool/);
expect(cliSource, "interactive browser branch", /else if !args\.plan[\s\S]*execute_interactive_browser_login/);
expect(cliSource, "browser command override", /DISASMER_BROWSER_OPEN_COMMAND/);
expect(cliSource, "server-owned login start", /"type": "begin_oidc_browser_login"[\s\S]*requested_project/);
expect(cliSource, "opaque login polling", /"type": "poll_oidc_browser_login"[\s\S]*transaction_id[\s\S]*polling_secret/);
expect(cliSource, "server-owned state nonce and PKCE", /server_owns_state: true[\s\S]*server_owns_nonce: true[\s\S]*pkce_required: true/);
expect(cliSource, "CLI receives no provider code or claims", /cli_receives_provider_authorization_code: false[\s\S]*cli_submits_identity_claims: false/);
assert.doesNotMatch(cliSource, /TcpListener::bind|authorization_code.*issuer_url.*client_id/s);
expect(cliSmoke, "smoke uses fake browser opener", /DISASMER_BROWSER_OPEN_COMMAND/);
expect(cliSmoke, "smoke verifies server-owned browser transaction", /server-owned browser transaction/);
expect(cliSmoke, "smoke rejects client OIDC authority", /assert\.deepStrictEqual\(request,[\s\S]*begin_oidc_browser_login[\s\S]*requested_project/);
expect(cliSmoke, "smoke verifies coordinator completion", /scoped_cli_session_received/);
expect(publicAcceptance, "public acceptance runs browser flow smoke", /node scripts\/cli-browser-login-flow-smoke\.js/);

if (fs.existsSync(infraRepo)) {
  const stack = read("modules/stack.nix", infraRepo);
  const hypervisor = read("hosts/hypervisor/default.nix", infraRepo);
  const oauth = read("modules/oauth-bootstrap.nix", infraRepo);
  const site = read("disasmer-site/index.html", infraRepo);

  expect(stack, "Disasmer public host", /publicHost = "disasmer\.michelpaulissen\.com"/);
  expect(stack, "Disasmer loopback API port", /apiPort = 9080/);
  expect(hypervisor, "nginx Disasmer vhost", /\$\{stack\.hosts\.disasmer\.publicHost\}/);
  expect(hypervisor, "nginx Disasmer site root", /root = \.\.\/\.\.\/disasmer-site/);
  expect(hypervisor, "nginx control API proxy", /locations\."= \/api\/v1\/control"[\s\S]*proxyPass/);
  expect(hypervisor, "nginx hosted callback proxy", /locations\."= \/auth\/callback"[\s\S]*proxyPass/);
  assert.doesNotMatch(hypervisor, /locations\."= \/auth\/browser\/start"/);
  expect(hypervisor, "hosted service uses configured API port", /stack\.hosts\.disasmer\.apiPort/);
  expect(oauth, "Disasmer Authentik provider", /name: disasmer-provider/);
  expect(oauth, "Disasmer public OIDC client", /client_type: public/);
  expect(oauth, "Disasmer client id", /client_id: \${disasmerClientId}/);
  expect(oauth, "Disasmer hosted callback", /https:\/\/disasmer\.michelpaulissen\.com\/auth\/callback/);
  expect(oauth, "Disasmer Authentik application", /slug: disasmer/);
  expect(site, "site describes CLI login", /disasmer login --browser/);
  expect(site, "site describes hosted callback authority", /hosted service processes the callback/);
  expect(site, "site explains attached-node execution", /placed on a node you attach and explicitly authorize/);
  expect(site, "site labels pre-release status", /pre-release deployment under active verification/);
  assert.doesNotMatch(site, /local callback|provider codes and tokens are returned to the CLI/i);
} else {
  console.warn("Skipping VPS config checks because ../michelpaulissen.com is not present");
}

console.log("Public browser login contract smoke passed");