#!/usr/bin/env node

const assert = require("assert");
const fs = require("fs");
const path = require("path");

const repo = path.resolve(__dirname, "..");

function read(file) {
  return fs.readFileSync(path.join(repo, file), "utf8");
}

function extractBalancedBlock(source, marker) {
  const start = source.indexOf(marker);
  assert(start >= 0, `missing marker ${marker}`);
  const open = source.indexOf("{", start);
  assert(open >= 0, `missing opening brace for ${marker}`);
  let depth = 0;
  for (let index = open; index < source.length; index += 1) {
    const char = source[index];
    if (char === "{") depth += 1;
    if (char === "}") {
      depth -= 1;
      if (depth === 0) return source.slice(start, index + 1);
    }
  }
  throw new Error(`missing closing brace for ${marker}`);
}

function extractEnumVariant(source, variant) {
  const marker = `    ${variant} {`;
  return extractBalancedBlock(source, marker);
}

const forbiddenUserSessionCredentials =
  /\b(BrowserSession|CliDeviceSession|BrowserLoginFlow|CliLoginFlow|authorization_url|verification_url|device_code|access_token|refresh_token|provider_token|provider_tokens|session_token|user_token|oauth_token)\b/i;

function assertNoUserSessionCredential(surface, text) {
  assert.doesNotMatch(
    text,
    forbiddenUserSessionCredentials,
    `${surface} must not carry user OAuth/browser/session credentials`
  );
}

const coordinatorService = read("crates/disasmer-coordinator/src/service.rs");
for (const variant of [
  "AttachNode",
  "RegisterAgentPublicKey",
  "ListAgentPublicKeys",
  "RotateAgentPublicKey",
  "RevokeAgentPublicKey",
  "NodeHeartbeat",
  "ReportNodeCapabilities",
  "RequestRendezvous",
  "RequestSourcePreparation",
  "CompleteSourcePreparation",
  "StartProcess",
  "ReconnectNode",
  "CancelTask",
  "CancelProcess",
  "PollTaskControl",
  "TaskCompleted",
]) {
  assertNoUserSessionCredential(
    `CoordinatorRequest::${variant}`,
    extractEnumVariant(coordinatorService, variant)
  );
}

const nodeRuntime = read("crates/disasmer-node/src/lib.rs");
for (const marker of [
  "pub struct LinuxCommandRunPlan",
  "pub struct LinuxCommandTaskOutput",
  "pub struct CapturedCommandLogs",
  "pub struct VirtualThreadCommand",
  "pub struct CommandOutput",
]) {
  assertNoUserSessionCredential(marker, extractBalancedBlock(nodeRuntime, marker));
}

const coreExecution = read("crates/disasmer-core/src/execution.rs");
assertNoUserSessionCredential(
  "CommandInvocation",
  extractBalancedBlock(coreExecution, "pub struct CommandInvocation")
);

const dapAdapter = read("crates/disasmer-dap/src/main.rs");
assertNoUserSessionCredential(
  "DAP variables response",
  extractBalancedBlock(dapAdapter, "fn variables_response")
);

const panel = read("crates/disasmer-core/src/operator_panel.rs");
assertNoUserSessionCredential(
  "PanelEvent",
  extractBalancedBlock(panel, "pub struct PanelEvent")
);

const auth = read("crates/disasmer-core/src/auth.rs");
assert.match(
  auth,
  /task_credentials_do_not_contain_user_session/,
  "core auth must keep the task credential user-session guard"
);
assert.match(
  auth,
  /CredentialKind::BrowserSession \| CredentialKind::CliDeviceSession/,
  "task credential guard must reject browser and CLI sessions"
);

console.log("User session token boundary smoke passed");