#!/usr/bin/env node
/**
 * Production-readiness gate.
 *
 * Answers one question: "would launching right now expose a class of fault we
 * have already seen?" Every HARD gate below exists because it caught a real
 * defect on 2026-07-26/27 — none are hypothetical.
 *
 *   privacy      GET /api/repos/:o/:n returned a PRIVATE repo's full row
 *                (isPrivate, ownerId, on-disk path) to an anonymous caller.
 *   api-json     /api/* 404s rendered a 126KB HTML page instead of JSON, so
 *                API and MCP clients failed opaquely.
 *   provenance   The container never received a build SHA, so /api/version
 *                reported "unknown" forever: the auto-update banner could
 *                never fire and the PWA cache key never rotated.
 *   render       Catches JS exceptions / broken images on real pages.
 *   overflow     /docs/agents was 3406px wide in a 1440 viewport; /login
 *                overflowed at 390px.
 *   auth-gate    Authenticated-only paths must not render to anonymous users.
 *
 * SOFT gates warn but do not block.
 *
 * Usage:
 *   node scripts/production-readiness.mjs [--base https://gluecron.com]
 *                                         [--expect-sha <sha>]
 *                                         [--private-repo owner/name]
 *                                         [--json out.json]
 *
 * Exit codes: 0 = all HARD gates pass · 1 = a HARD gate failed · 2 = crashed.
 *
 * Deliberately does NOT authenticate. Everything here must hold for an
 * anonymous visitor, which is exactly the threat model for opening signups.
 */

import { chromium } from '@playwright/test';
import { writeFileSync } from 'fs';

const argv = process.argv.slice(2);
const arg = (name, fallback = null) => {
  const i = argv.indexOf(`--${name}`);
  return i >= 0 && argv[i + 1] ? argv[i + 1] : fallback;
};

const BASE = (arg('base', process.env.SMOKE_HOST || 'https://gluecron.com')).replace(/\/$/, '');
const EXPECT_SHA = arg('expect-sha', process.env.EXPECT_SHA);
const PRIVATE_REPO = arg('private-repo', process.env.PRIVATE_REPO); // "owner/name"
const JSON_OUT = arg('json');

// Pages sampled for render/overflow gates. Keep this list small and
// representative — it runs on every deploy.
const PAGES = [
  '/', '/explore', '/pricing', '/docs', '/docs/agents', '/docs/api',
  '/login', '/register', '/marketplace', '/enterprise',
];
// Must never render for an anonymous caller.
const AUTH_ONLY = ['/dashboard', '/settings', '/admin', '/settings/tokens'];
const PERF_BUDGET_MS = 3000; // soft

const results = [];
const add = (gate, hard, ok, detail) => results.push({ gate, hard, ok, detail });

async function main() {
  console.log(`[readiness] target: ${BASE}\n`);

  // ── HARD: build provenance ────────────────────────────────────────────
  try {
    const r = await fetch(`${BASE}/api/version`);
    const v = await r.json();
    const sha = String(v.sha || '');
    const bad = !sha || sha === 'unknown' || sha === 'dev';
    if (bad) {
      add('provenance', true, false,
        `/api/version reports sha="${sha}" — the build SHA never reached the running process, so deploy detection and PWA cache-busting are both inert`);
    } else if (EXPECT_SHA && !EXPECT_SHA.startsWith(v.shaFull) && !v.shaFull?.startsWith(sha)) {
      add('provenance', true, false, `live sha ${v.shaFull} != expected ${EXPECT_SHA} — deploy did not land`);
    } else {
      add('provenance', true, true, `sha=${sha} builtAt=${v.builtAt}`);
    }
  } catch (e) {
    add('provenance', true, false, `/api/version unreachable: ${e.message}`);
  }

  // ── HARD: /api/* must speak JSON, never HTML ──────────────────────────
  try {
    const r = await fetch(`${BASE}/api/definitely-not-a-real-endpoint-${Date.now()}`);
    const ct = r.headers.get('content-type') || '';
    const body = (await r.text()).slice(0, 400);
    const isHtml = ct.includes('text/html') || body.trimStart().startsWith('<');
    add('api-json', true, !isHtml,
      isHtml
        ? `unknown /api/* path returned ${r.status} as ${ct || 'HTML'} — API and MCP clients cannot parse this`
        : `unknown /api/* path returned ${r.status} as ${ct}`);
  } catch (e) {
    add('api-json', true, false, `probe failed: ${e.message}`);
  }

  // ── HARD: a private repo must not be disclosed anonymously ────────────
  if (PRIVATE_REPO) {
    const [o, n] = PRIVATE_REPO.split('/');
    const surfaces = [`/api/repos/${o}/${n}`, `/${o}/${n}`, `/api/v2/repos/${o}/${n}`];
    const leaks = [];
    for (const path of surfaces) {
      try {
        const r = await fetch(`${BASE}${path}`);
        if (r.status !== 200) continue;
        const body = await r.text();
        // A 200 alone is not proof; look for fields only the real row carries.
        if (/"isPrivate"|"diskPath"|"ownerId"/.test(body)) {
          leaks.push(`${path} -> 200 disclosing repo metadata`);
        }
      } catch { /* unreachable surface is not a leak */ }
    }
    add('privacy', true, leaks.length === 0,
      leaks.length ? leaks.join('; ') : `no anonymous disclosure across ${surfaces.length} surfaces`);
  } else {
    add('privacy', true, true, 'SKIPPED — pass --private-repo owner/name to enable (strongly recommended)');
  }

  // ── HARD: auth-only pages must not render anonymously ─────────────────
  const rendered = [];
  for (const p of AUTH_ONLY) {
    try {
      const r = await fetch(`${BASE}${p}`, { redirect: 'manual' });
      // 2xx that actually renders the page is the failure. 3xx/401/404 are fine.
      if (r.status >= 200 && r.status < 300) {
        const body = await r.text();
        if (!/sign in|log ?in|password/i.test(body.slice(0, 4000))) rendered.push(`${p} -> ${r.status}`);
      }
    } catch { /* ignore */ }
  }
  add('auth-gate', true, rendered.length === 0,
    rendered.length ? `rendered to anonymous caller: ${rendered.join(', ')}` : `${AUTH_ONLY.length} paths correctly gated`);

  // ── Render + overflow gates (real browser) ────────────────────────────
  const browser = await chromium.launch();
  const jsErrors = [], overflows = [], brokenImgs = [], slow = [], noH1 = [];

  for (const vp of [{ w: 1440, h: 900 }, { w: 390, h: 844 }]) {
    const ctx = await browser.newContext({ viewport: { width: vp.w, height: vp.h } });
    for (const path of PAGES) {
      const page = await ctx.newPage();
      const errs = [];
      page.on('pageerror', (e) => errs.push(String(e).slice(0, 200)));
      const t0 = Date.now();
      try {
        await page.goto(BASE + path, { waitUntil: 'domcontentloaded', timeout: 45000 });
        try { await page.waitForLoadState('networkidle', { timeout: 8000 }); } catch {}
        const ms = Date.now() - t0;
        const probe = await page.evaluate(() => ({
          scrollW: document.documentElement.scrollWidth,
          innerW: window.innerWidth,
          h1: document.querySelectorAll('h1').length,
          broken: Array.from(document.images)
            .filter((im) => im.complete && im.naturalWidth === 0)
            .map((im) => im.src.slice(0, 120)),
        }));
        if (probe.scrollW > probe.innerW + 2) {
          overflows.push(`${path} @${vp.w}: ${probe.scrollW}px (+${probe.scrollW - probe.innerW})`);
        }
        if (probe.broken.length) brokenImgs.push(`${path}: ${probe.broken.length}`);
        if (vp.w === 1440) {
          if (probe.h1 === 0) noH1.push(path);
          if (ms > PERF_BUDGET_MS) slow.push(`${path} ${ms}ms`);
        }
      } catch (e) {
        errs.push(`navigation failed: ${String(e).slice(0, 160)}`);
      }
      if (errs.length) jsErrors.push(`${path} @${vp.w}: ${errs[0]}`);
      await page.close();
    }
    await ctx.close();
  }
  await browser.close();

  add('render', true, jsErrors.length === 0,
    jsErrors.length ? jsErrors.slice(0, 5).join(' | ') : `${PAGES.length} pages x2 viewports, no uncaught JS errors`);
  add('overflow', true, overflows.length === 0,
    overflows.length ? overflows.slice(0, 6).join(' | ') : 'no horizontal overflow at 1440 or 390');
  add('images', false, brokenImgs.length === 0,
    brokenImgs.length ? brokenImgs.join(' | ') : 'no broken images');
  add('headings', false, noH1.length === 0,
    noH1.length ? `${noH1.length} page(s) with no <h1>: ${noH1.slice(0, 6).join(', ')}` : 'every sampled page has an h1');
  add('perf', false, slow.length === 0,
    slow.length ? `over ${PERF_BUDGET_MS}ms: ${slow.join(', ')}` : `all sampled pages under ${PERF_BUDGET_MS}ms`);

  // ── Report ────────────────────────────────────────────────────────────
  const pad = (s, n) => String(s).padEnd(n);
  console.log(pad('GATE', 13) + pad('KIND', 7) + pad('RESULT', 8) + 'DETAIL');
  console.log('-'.repeat(100));
  for (const r of results) {
    console.log(
      pad(r.gate, 13) + pad(r.hard ? 'HARD' : 'soft', 7) +
      pad(r.ok ? 'PASS' : 'FAIL', 8) + r.detail
    );
  }

  const hardFails = results.filter((r) => r.hard && !r.ok);
  const softFails = results.filter((r) => !r.hard && !r.ok);
  console.log('');
  console.log(`[readiness] HARD ${results.filter(r => r.hard && r.ok).length}/${results.filter(r => r.hard).length} passed · soft warnings: ${softFails.length}`);

  if (JSON_OUT) {
    writeFileSync(JSON_OUT, JSON.stringify({ base: BASE, results }, null, 2));
    console.log(`[readiness] wrote ${JSON_OUT}`);
  }

  if (hardFails.length) {
    console.error(`\n[readiness] NOT READY — ${hardFails.length} hard gate(s) failed:`);
    for (const f of hardFails) console.error(`  - ${f.gate}: ${f.detail}`);
    process.exit(1);
  }
  console.log('\n[readiness] all hard gates passed');
  process.exit(0);
}

main().catch((e) => {
  console.error('[readiness] crashed:', e);
  process.exit(2);
});