#!/usr/bin/env node

const assert = require("assert");
const fs = require("fs");
const path = require("path");

const repo = path.resolve(__dirname, "..");
const infraRepo = path.resolve(repo, "..", "michelpaulissen.com");

function read(relativePath, base = repo) {
  return fs.readFileSync(path.join(base, relativePath), "utf8");
}

function expect(source, name, pattern) {
  assert.match(source, pattern, `missing public browser login evidence: ${name}`);
}

const cliSource = read("crates/disasmer-cli/src/main.rs");
const cliSmoke = read("scripts/cli-browser-login-flow-smoke.js");
const publicAcceptance = read("scripts/acceptance-public.sh");
const phase2 = read("acceptance_criteria_phase2.md");
const base = read("acceptance_criteria.md");

for (const [name, source] of [
  ["base acceptance", base],
  ["phase 2 acceptance", phase2],
]) {
  expect(source, `${name} released binary browser criterion`, /Public released binaries default to a real human browser\/account flow/);
}

expect(cliSource, "browser login start constant", /DEFAULT_BROWSER_LOGIN_START: &str = "https:\/\/disasmer\.michelpaulissen\.com\/auth\/browser\/start"/);
expect(cliSource, "default OIDC issuer", /DEFAULT_OIDC_ISSUER_URL: &str = "https:\/\/auth\.michelpaulissen\.com"/);
expect(cliSource, "fixed localhost callback", /BROWSER_CALLBACK_ADDR: &str = "127\.0\.0\.1:45173"/);
expect(cliSource, "diagnostic plan flag", /plan: bool/);
expect(cliSource, "interactive browser branch", /args\.browser && !args\.plan[\s\S]*execute_interactive_browser_login/);
expect(cliSource, "browser command override", /DISASMER_BROWSER_OPEN_COMMAND/);
expect(cliSource, "callback listener", /TcpListener::bind\(BROWSER_CALLBACK_ADDR\)/);
expect(cliSource, "callback completion", /execute_browser_login_completion_for_plan\(args, plan\)/);
expect(cliSmoke, "smoke uses fake browser opener", /DISASMER_BROWSER_OPEN_COMMAND/);
expect(cliSmoke, "smoke verifies callback code", /browser-smoke-code/);
expect(cliSmoke, "smoke verifies coordinator completion", /scoped_cli_session_received/);
expect(publicAcceptance, "public acceptance runs browser flow smoke", /node scripts\/cli-browser-login-flow-smoke\.js/);

if (fs.existsSync(infraRepo)) {
  const stack = read("modules/stack.nix", infraRepo);
  const hypervisor = read("hosts/hypervisor/default.nix", infraRepo);
  const oauth = read("modules/oauth-bootstrap.nix", infraRepo);
  const site = read("disasmer-site/index.html", infraRepo);

  expect(stack, "Disasmer public host", /publicHost = "disasmer\.michelpaulissen\.com"/);
  expect(stack, "Disasmer API port", /apiPort = 9443/);
  expect(hypervisor, "nginx Disasmer vhost", /\$\{stack\.hosts\.disasmer\.publicHost\}/);
  expect(hypervisor, "nginx Disasmer site root", /root = \.\.\/\.\.\/disasmer-site/);
  expect(hypervisor, "nginx browser start route", /locations\."= \/auth\/browser\/start"\.return/);
  expect(hypervisor, "nginx redirects to Authentik", /https:\/\/\$\{stack\.hosts\.authentik\.publicHost\}\/application\/o\/authorize/);
  expect(hypervisor, "nginx passes state", /state=\$arg_state/);
  expect(hypervisor, "nginx passes redirect URI", /redirect_uri=\$arg_redirect_uri/);
  expect(hypervisor, "hosted service uses configured API port", /stack\.hosts\.disasmer\.apiPort/);
  expect(oauth, "Disasmer Authentik provider", /name: disasmer-provider/);
  expect(oauth, "Disasmer public OIDC client", /client_type: public/);
  expect(oauth, "Disasmer client id", /client_id: \${disasmerClientId}/);
  expect(oauth, "Disasmer localhost redirect", /http:\/\/127\.0\.0\.1:45173\/callback/);
  expect(oauth, "Disasmer Authentik application", /slug: disasmer/);
  expect(site, "barebones site describes CLI login", /disasmer login --browser/);
  expect(site, "barebones site states UX deferral", /Layout and UX work are deferred/);
  assert.doesNotMatch(site, /<style|stylesheet|\.css|style=|class=/i, "Disasmer dry-run site must remain barebones HTML with no CSS");
} else {
  console.warn("Skipping VPS config checks because ../michelpaulissen.com is not present");
}

console.log("Public browser login contract smoke passed");