/**
 * Every state-changing route is either guarded or explicitly declared public.
 *
 * POST /api/repos took the target namespace from the request body and had no
 * auth middleware at all, so anyone could create repositories in anyone's
 * account. POST /api/setup upserted a user with the fixed password
 * "changeme". Both shipped because nothing enumerated the write surface —
 * there are 413 state-changing routes and no list of which ones are meant to
 * be reachable anonymously.
 *
 * This test does not try to prove a route is *correctly* authorized; static
 * analysis can't, and there are at least five guard idioms in this codebase
 * (inline middleware, router-level `.use("*")`, router prefix `.use("/x/*")`,
 * an in-handler `gate(c)` returning a Response, and bespoke helpers like
 * `requireSandboxAdmin`). What it does is force a decision: a write route
 * either matches a recognised guard idiom, or it appears in PUBLIC_WRITES
 * with a stated reason. A newly added unguarded write fails the build.
 *
 * When this test fails on a route you added: if it should be authenticated,
 * add a guard. If it genuinely must be public — an auth entry point, a
 * third-party webhook receiver, the git protocol — add it to PUBLIC_WRITES
 * with the reason.
 */

import { describe, expect, it } from "bun:test";
import { readdirSync, readFileSync, statSync } from "fs";
import { join } from "path";

const ROOT = "src/routes";

/** Guards that appear in middleware position on the route registration. */
const MIDDLEWARE_GUARD =
  /requireAuth|requireApiAuth|requireAdmin|requireScope|requireRepoAccess|requireOrgRole|agentAuth|adminOnly/;

/**
 * Guards that appear inside the handler body and return a Response on
 * failure before any state is touched.
 */
const HANDLER_GUARD =
  /\bgate\(c\)|require[A-Z]\w*\(c\)|isSiteAdmin|assertAdmin|assertRepoReadable|assertRepoWritable|resolveRepoAccess|c\.get\("user"\)!|const viewer = c\.get\("user"\)|const user = c\.get\("user"\)|if \(!c\.get\("user"\)\)|verifyBearer|authenticateBearer|verifyPatAuth|verifySignature|EMERGENCY_PAT_SECRET|scimAuth|verifyScimToken/;

/**
 * Write routes that are reachable anonymously ON PURPOSE. Each needs a
 * reason, because "it was already like that" is how POST /api/setup survived.
 */
const PUBLIC_WRITES: Record<string, string> = {
  // Authentication entry points — cannot require an existing session.
  "POST /register": "signup",
  "POST /login": "sign-in",
  "POST /login/2fa": "second factor; the session exists but is not yet valid",
  "POST /login/magic": "magic-link request",
  "POST /api/auth/register": "signup (API)",
  "POST /api/auth/login": "sign-in (API)",
  "POST /oauth/token": "OAuth token exchange; authenticates via client creds",
  "POST /api/passkeys/auth/options": "WebAuthn sign-in challenge; username optional, no session yet",
  "POST /api/passkeys/auth/verify": "WebAuthn sign-in; authenticates via the signed assertion",
  "POST /forgot-password": "password reset request",
  "POST /reset-password": "password reset completion; authenticates via token",

  // Git Smart HTTP — authenticates itself via lib/git-push-auth.ts.
  "POST /:owner/:repo.git/git-upload-pack": "git protocol, own auth",
  "POST /:owner/:repo.git/git-receive-pack": "git protocol, own auth",

  // Third-party webhook receivers — authenticate by signature, not session.
  "POST /api/hooks/gatetest": "GateTest callback",
  "POST /hooks/pagerduty": "incident webhook",
  "POST /hooks/datadog": "incident webhook",
  "POST /hooks/opsgenie": "incident webhook",
  "POST /hooks/incident": "incident webhook",
  "POST /api/v2/integrations/slack/events": "Slack Events API",
  "POST /api/v2/integrations/discord/interactions": "Discord interactions",
  "POST /api/webhooks/stripe": "Stripe webhook; verified by stripe-signature",
  "POST /sso/saml/:orgSlug/callback": "SAML assertion consumer; authenticates via the signed assertion",

  // Bearer-token surfaces whose guard helper this scan does not recognise.
  // Each was read and confirmed to reject an unauthenticated caller.
  "POST /api/v1/runs/:runId/artifacts": "CI artifact upload; glc_ PAT bearer with repo/write scope",
  "DELETE /api/v1/artifacts/:artifactId": "CI artifact delete; glc_ PAT bearer",
  "POST /deploy/started": "deploy event; Authorization: Bearer DEPLOY_EVENT_TOKEN",
  "POST /deploy/finished": "deploy event; Authorization: Bearer DEPLOY_EVENT_TOKEN",
  "POST /deploy/step": "deploy event; Authorization: Bearer DEPLOY_EVENT_TOKEN",
  "POST /v2/*": "OCI registry; Docker Basic auth validated against api_tokens",
  "PUT /v2/*": "OCI registry; Docker Basic auth validated against api_tokens",
  "PATCH /v2/*": "OCI registry; Docker Basic auth validated against api_tokens",
  "DELETE /v2/*": "OCI registry; Docker Basic auth validated against api_tokens",

  // OAuth endpoints that are public by specification.
  "POST /oauth/register": "RFC 7591 dynamic client registration",
  "POST /oauth/revoke": "RFC 7009 revocation; authenticates via the token itself",
  "POST /api/v2/integrations/slack/install": "OAuth install redirect start",
  "POST /api/v2/integrations/discord/install": "OAuth install redirect start",

  // Deliberately public product surfaces.
  "POST /loops/:slug/invoke": "public hosted loop; gated on loop.isPublic",
  "POST /enterprise/contact": "contact form",
  "POST /markdown/preview": "stateless render, touches no state",
  "POST /play": "playground account creation; the point is to need no account",
  "POST /status/subscribe": "status-page email subscription",
  "POST /flywheel-telemetry/feedback": "anonymous product telemetry",
  "POST /api/claude/session": "fire-and-forget session telemetry, documented as no-auth",
  "POST /setup": "first-run bootstrap; refuses once the users table is non-empty",
};

function walk(d: string): string[] {
  const out: string[] = [];
  for (const e of readdirSync(d)) {
    const p = join(d, e);
    if (statSync(p).isDirectory()) out.push(...walk(p));
    else if (e.endsWith(".ts") || e.endsWith(".tsx")) out.push(p);
  }
  return out;
}

type Route = { method: string; path: string; file: string; guard: string };

function analyze(): Route[] {
  const routes: Route[] = [];
  for (const f of walk(ROOT)) {
    const src = readFileSync(f, "utf8");
    const rel = f.replace(/\\/g, "/").split("/routes/")[1];

    const prefixGuards: string[] = [];
    let guardAll = false;
    for (const m of src.matchAll(/\.use\(\s*(["'`])([^"'`]*)\1\s*,([\s\S]{0,200}?)\)\s*;/g)) {
      if (!MIDDLEWARE_GUARD.test(m[3])) continue;
      if (m[2] === "*") guardAll = true;
      else prefixGuards.push(m[2]);
    }

    const re = /\.(post|put|patch|delete)\(\s*(["'`])([^"'`\n]*)\2/g;
    let m;
    while ((m = re.exec(src))) {
      const path = m[3];
      if (!path.startsWith("/")) continue;
      const window = src.slice(m.index, m.index + 1200);
      // Middleware sits between the path literal and the handler arrow.
      const arrow = window.indexOf("=>");
      const sig = arrow > -1 ? window.slice(0, arrow) : window.slice(0, 300);

      let guard = "NONE";
      if (MIDDLEWARE_GUARD.test(sig)) guard = "inline";
      else if (guardAll) guard = "router-*";
      else if (prefixGuards.some((g) => { const p = g.replace(/\*$/, ""); return p && path.startsWith(p); })) guard = "router-prefix";
      else if (HANDLER_GUARD.test(window)) guard = "in-handler";
      routes.push({ method: m[1].toUpperCase(), path, file: rel, guard });
    }
  }
  return routes;
}

const ROUTES = analyze();

describe("state-changing routes", () => {
  it("finds a substantial write surface (guards against the scan silently breaking)", () => {
    // If a refactor breaks the regex this test would vacuously pass, so
    // assert the scan still sees roughly the surface we know exists.
    expect(ROUTES.length).toBeGreaterThan(300);
  });

  it("every unguarded write is explicitly declared public", () => {
    const unexplained = ROUTES
      .filter((r) => r.guard === "NONE")
      .filter((r) => !(`${r.method} ${r.path}` in PUBLIC_WRITES))
      .map((r) => `${r.method} ${r.path}  (${r.file})`)
      .sort();
    expect(unexplained).toEqual([]);
  });

  it("every PUBLIC_WRITES entry carries a reason", () => {
    for (const [route, reason] of Object.entries(PUBLIC_WRITES)) {
      expect(reason.length, `${route} needs a reason`).toBeGreaterThan(3);
    }
  });

  it("PUBLIC_WRITES has no stale entries", () => {
    // A route that gained a guard, or was deleted, should leave the list —
    // otherwise the allowlist rots into a blanket exemption.
    const live = new Set(
      ROUTES.filter((r) => r.guard === "NONE").map((r) => `${r.method} ${r.path}`)
    );
    const stale = Object.keys(PUBLIC_WRITES).filter((k) => !live.has(k));
    expect(stale).toEqual([]);
  });
});