#!/usr/bin/env node
/**
 * Production-readiness gate.
 *
 * Answers one question: "would launching right now expose a class of fault we
 * have already seen?" Every HARD gate below exists because it caught a real
 * defect on 2026-07-26/27 — none are hypothetical.
 *
 *   privacy      GET /api/repos/:o/:n returned a PRIVATE repo's full row
 *                (isPrivate, ownerId, on-disk path) to an anonymous caller.
 *   api-json     /api/* 404s rendered a 126KB HTML page instead of JSON, so
 *                API and MCP clients failed opaquely.
 *   provenance   The container never received a build SHA, so /api/version
 *                reported "unknown" forever: the auto-update banner could
 *                never fire and the PWA cache key never rotated.
 *   render       Catches JS exceptions / broken images on real pages.
 *   overflow     /docs/agents was 3406px wide in a 1440 viewport; /login
 *                overflowed at 390px.
 *   auth-gate    Authenticated-only paths must not render to anonymous users.
 *
 * SOFT gates warn but do not block.
 *
 * Usage:
 *   node scripts/production-readiness.mjs [--base https://gluecron.com]
 *                                         [--expect-sha <sha>]
 *                                         [--private-repo owner/name]
 *                                         [--json out.json]
 *
 * Exit codes: 0 = all HARD gates pass · 1 = a HARD gate failed · 2 = crashed.
 *
 * Deliberately does NOT authenticate. Everything here must hold for an
 * anonymous visitor, which is exactly the threat model for opening signups.
 */

import { chromium } from '@playwright/test';
import { writeFileSync, readdirSync, readFileSync, statSync } from 'fs';
import { join } from 'path';

const argv = process.argv.slice(2);
const arg = (name, fallback = null) => {
  const i = argv.indexOf(`--${name}`);
  return i >= 0 && argv[i + 1] ? argv[i + 1] : fallback;
};

const BASE = (arg('base', process.env.SMOKE_HOST || 'https://gluecron.com')).replace(/\/$/, '');
const EXPECT_SHA = arg('expect-sha', process.env.EXPECT_SHA);
const PRIVATE_REPO = arg('private-repo', process.env.PRIVATE_REPO); // "owner/name"
const PUBLIC_REPO = arg('public-repo', process.env.PUBLIC_REPO); // "owner/name"
const OWNER_PAT = process.env.GLUECRON_PAT; // owner of PRIVATE_REPO
const NONMEMBER_PAT = process.env.NONMEMBER_PAT; // any account with no access
const JSON_OUT = arg('json');

/**
 * Every repo-scoped route the app registers, read from source at run time.
 *
 * Deliberately NOT a hand-maintained list. The 24 private-repo subpages that
 * were leaking on 2026-07-28 leaked precisely because each route owned its own
 * privacy check and nobody kept a central list in step. A gate with a literal
 * array would drift the same way — a route added tomorrow would be untested
 * and silently uncovered. Parsing the router registrations means new routes are
 * covered the moment they exist.
 */
function repoScopedGetRoutes(root = 'src/routes') {
  const files = [];
  const walk = (d) => {
    for (const e of readdirSync(d)) {
      const p = join(d, e);
      if (statSync(p).isDirectory()) walk(p);
      else if (e.endsWith('.ts') || e.endsWith('.tsx')) files.push(p);
    }
  };
  try { walk(root); } catch { return []; }

  const re = /\.(get)\(\s*(["'`])(\/:owner\/:repo[^"'`\n]*)\2/g;
  const paths = new Set();
  for (const f of files) {
    const src = readFileSync(f, 'utf8');
    let m;
    re.lastIndex = 0;
    while ((m = re.exec(src))) {
      let p = m[3];
      // Skip the git Smart HTTP surface: `:repo.git` has its own auth and
      // returns 401, not a page.
      if (p.includes('.git')) continue;
      // Drop Hono regex constraints: "/:ref{.+$}" -> "/:ref".
      p = p.replace(/\{[^}]*\}/g, '');
      // Routes needing a synthetic id we cannot fabricate are still worth
      // probing — a bogus id should 404, so a 200 is a leak either way.
      paths.add(p);
    }
  }
  return [...paths].sort();
}

/** Fill :owner/:repo, and give any remaining params a placeholder. */
function materialize(routePath, owner, repo) {
  return routePath
    .replace('/:owner/:repo', `/${owner}/${repo}`)
    .replace(/\/:[A-Za-z_]+\??/g, '/_probe')
    .replace(/\/\*$/, '/_probe');
}

// Pages sampled for render/overflow gates. Keep this list small and
// representative — it runs on every deploy.
const PAGES = [
  '/', '/explore', '/pricing', '/docs', '/docs/agents', '/docs/api',
  '/login', '/register', '/marketplace', '/enterprise',
];
// Must never render for an anonymous caller.
const AUTH_ONLY = ['/dashboard', '/settings', '/admin', '/settings/tokens'];
const PERF_BUDGET_MS = 3000; // soft

const results = [];
const add = (gate, hard, ok, detail) => results.push({ gate, hard, ok, detail });

async function main() {
  console.log(`[readiness] target: ${BASE}\n`);

  // ── HARD: build provenance ────────────────────────────────────────────
  try {
    const r = await fetch(`${BASE}/api/version`);
    const v = await r.json();
    const sha = String(v.sha || '');
    const bad = !sha || sha === 'unknown' || sha === 'dev';
    if (bad) {
      add('provenance', true, false,
        `/api/version reports sha="${sha}" — the build SHA never reached the running process, so deploy detection and PWA cache-busting are both inert`);
    } else if (EXPECT_SHA && !EXPECT_SHA.startsWith(v.shaFull) && !v.shaFull?.startsWith(sha)) {
      add('provenance', true, false, `live sha ${v.shaFull} != expected ${EXPECT_SHA} — deploy did not land`);
    } else {
      add('provenance', true, true, `sha=${sha} builtAt=${v.builtAt}`);
    }
  } catch (e) {
    add('provenance', true, false, `/api/version unreachable: ${e.message}`);
  }

  // ── HARD: /api/* must speak JSON, never HTML ──────────────────────────
  try {
    const r = await fetch(`${BASE}/api/definitely-not-a-real-endpoint-${Date.now()}`);
    const ct = r.headers.get('content-type') || '';
    const body = (await r.text()).slice(0, 400);
    const isHtml = ct.includes('text/html') || body.trimStart().startsWith('<');
    add('api-json', true, !isHtml,
      isHtml
        ? `unknown /api/* path returned ${r.status} as ${ct || 'HTML'} — API and MCP clients cannot parse this`
        : `unknown /api/* path returned ${r.status} as ${ct}`);
  } catch (e) {
    add('api-json', true, false, `probe failed: ${e.message}`);
  }

  // ── HARD: a private repo must not be disclosed anonymously ────────────
  if (PRIVATE_REPO) {
    const [o, n] = PRIVATE_REPO.split('/');
    const surfaces = [`/api/repos/${o}/${n}`, `/${o}/${n}`, `/api/v2/repos/${o}/${n}`];
    const leaks = [];
    for (const path of surfaces) {
      try {
        const r = await fetch(`${BASE}${path}`);
        if (r.status !== 200) continue;
        const body = await r.text();
        // A 200 alone is not proof; look for fields only the real row carries.
        if (/"isPrivate"|"diskPath"|"ownerId"/.test(body)) {
          leaks.push(`${path} -> 200 disclosing repo metadata`);
        }
      } catch { /* unreachable surface is not a leak */ }
    }
    add('privacy', true, leaks.length === 0,
      leaks.length ? leaks.join('; ') : `no anonymous disclosure across ${surfaces.length} surfaces`);
  } else {
    add('privacy', true, true, 'SKIPPED — pass --private-repo owner/name to enable (strongly recommended)');
  }

  // ── HARD: authorization matrix over EVERY repo-scoped route ───────────
  //
  // The gate that would have caught most of 2026-07-27/28. On that date the
  // three narrow `privacy` surfaces above all passed while 24 other
  // repo-scoped subpages served a private repo to anonymous visitors, because
  // nothing enumerated the full surface.
  //
  // Checks BOTH directions on purpose. "Private is blocked" alone would pass
  // trivially if a change broke every repo page, so the public repo must keep
  // rendering. A one-directional privacy test is how over-blocking ships.
  if (PRIVATE_REPO && PUBLIC_REPO) {
    const [po, pn] = PRIVATE_REPO.split('/');
    const [uo, un] = PUBLIC_REPO.split('/');
    const routes = repoScopedGetRoutes();
    const leaks = [];
    const overblocked = [];
    const errors = [];

    const probe = async (path, token) => {
      const headers = token ? { authorization: `Bearer ${token}` } : {};
      try {
        const r = await fetch(`${BASE}${path}`, { headers, redirect: 'manual' });
        return r.status;
      } catch {
        return 0;
      }
    };

    // Bounded concurrency. Serially this is 50+ routes x 3 identities of
    // round-trip latency — over ten minutes, which is long enough that nobody
    // runs the gate, and a gate nobody runs is worth nothing. Capped low
    // because hammering the server produces spurious slow-render timeouts in
    // the perf gate below.
    const LIMIT = 6;
    let cursor = 0;
    const worker = async () => {
      for (;;) {
        const i = cursor++;
        if (i >= routes.length) return;
        await checkRoute(routes[i]);
      }
    };

    async function checkRoute(route) {
      // 1. Private repo must not render to an anonymous caller.
      const anon = await probe(materialize(route, po, pn), null);
      if (anon === 200) leaks.push(`anon ${route} -> 200`);

      // 2. ...nor to a signed-in account with no access, when one is supplied.
      if (NONMEMBER_PAT) {
        const nm = await probe(materialize(route, po, pn), NONMEMBER_PAT);
        if (nm === 200) leaks.push(`non-member ${route} -> 200`);
      }

      // 3. The OWNER must always reach their own repo. Probing this
      //    anonymously would be wrong: plenty of repo routes legitimately
      //    require a session (the AI surfaces — /ask, /chat, /claude — all
      //    302 to login by design). Over-blocking means the owner is shut
      //    out, which is what a too-aggressive privacy gate actually breaks.
      if (OWNER_PAT) {
        const own = await probe(materialize(route, uo, un), OWNER_PAT);
        if (own === 302 || own === 401 || own === 403) {
          overblocked.push(`owner ${route} -> ${own}`);
        }
        // A placeholder id must 404, never crash the handler.
        if (own >= 500) errors.push(`${route} -> ${own}`);
      }
    }

    const detail = [];
    if (leaks.length) detail.push(`LEAK: ${leaks.slice(0, 8).join(', ')}`);
    if (overblocked.length) detail.push(`OVER-BLOCKED: ${overblocked.slice(0, 8).join(', ')}`);
    if (errors.length) detail.push(`5xx: ${errors.slice(0, 8).join(', ')}`);
    const covered = `${routes.length} repo routes x ${NONMEMBER_PAT ? 3 : 2} identities`;
    add('authz-matrix', true, leaks.length === 0 && overblocked.length === 0 && errors.length === 0,
      detail.length ? detail.join(' | ') : `${covered}, no leaks or over-blocking`
      + (NONMEMBER_PAT ? '' : ' (set NONMEMBER_PAT for the non-member row)'));
  } else {
    add('authz-matrix', true, true,
      'SKIPPED — needs --private-repo AND --public-repo (this is the gate that catches leaks; enable it)');
  }

  // ── HARD: auth-only pages must not render anonymously ─────────────────
  const rendered = [];
  for (const p of AUTH_ONLY) {
    try {
      const r = await fetch(`${BASE}${p}`, { redirect: 'manual' });
      // 2xx that actually renders the page is the failure. 3xx/401/404 are fine.
      if (r.status >= 200 && r.status < 300) {
        const body = await r.text();
        if (!/sign in|log ?in|password/i.test(body.slice(0, 4000))) rendered.push(`${p} -> ${r.status}`);
      }
    } catch { /* ignore */ }
  }
  add('auth-gate', true, rendered.length === 0,
    rendered.length ? `rendered to anonymous caller: ${rendered.join(', ')}` : `${AUTH_ONLY.length} paths correctly gated`);

  // ── Render + overflow gates (real browser) ────────────────────────────
  const browser = await chromium.launch();
  const jsErrors = [], overflows = [], brokenImgs = [], slow = [], noH1 = [];

  for (const vp of [{ w: 1440, h: 900 }, { w: 390, h: 844 }]) {
    const ctx = await browser.newContext({ viewport: { width: vp.w, height: vp.h } });
    for (const path of PAGES) {
      const page = await ctx.newPage();
      const errs = [];
      page.on('pageerror', (e) => errs.push(String(e).slice(0, 200)));
      const t0 = Date.now();
      try {
        await page.goto(BASE + path, { waitUntil: 'domcontentloaded', timeout: 45000 });
        try { await page.waitForLoadState('networkidle', { timeout: 8000 }); } catch {}
        const ms = Date.now() - t0;
        const probe = await page.evaluate(() => ({
          scrollW: document.documentElement.scrollWidth,
          innerW: window.innerWidth,
          h1: document.querySelectorAll('h1').length,
          broken: Array.from(document.images)
            .filter((im) => im.complete && im.naturalWidth === 0)
            .map((im) => im.src.slice(0, 120)),
        }));
        if (probe.scrollW > probe.innerW + 2) {
          overflows.push(`${path} @${vp.w}: ${probe.scrollW}px (+${probe.scrollW - probe.innerW})`);
        }
        if (probe.broken.length) brokenImgs.push(`${path}: ${probe.broken.length}`);
        if (vp.w === 1440) {
          if (probe.h1 === 0) noH1.push(path);
          if (ms > PERF_BUDGET_MS) slow.push(`${path} ${ms}ms`);
        }
      } catch (e) {
        errs.push(`navigation failed: ${String(e).slice(0, 160)}`);
      }
      if (errs.length) jsErrors.push(`${path} @${vp.w}: ${errs[0]}`);
      await page.close();
    }
    await ctx.close();
  }
  await browser.close();

  add('render', true, jsErrors.length === 0,
    jsErrors.length ? jsErrors.slice(0, 5).join(' | ') : `${PAGES.length} pages x2 viewports, no uncaught JS errors`);
  add('overflow', true, overflows.length === 0,
    overflows.length ? overflows.slice(0, 6).join(' | ') : 'no horizontal overflow at 1440 or 390');
  add('images', false, brokenImgs.length === 0,
    brokenImgs.length ? brokenImgs.join(' | ') : 'no broken images');
  add('headings', false, noH1.length === 0,
    noH1.length ? `${noH1.length} page(s) with no <h1>: ${noH1.slice(0, 6).join(', ')}` : 'every sampled page has an h1');
  add('perf', false, slow.length === 0,
    slow.length ? `over ${PERF_BUDGET_MS}ms: ${slow.join(', ')}` : `all sampled pages under ${PERF_BUDGET_MS}ms`);

  // ── Report ────────────────────────────────────────────────────────────
  const pad = (s, n) => String(s).padEnd(n);
  console.log(pad('GATE', 13) + pad('KIND', 7) + pad('RESULT', 8) + 'DETAIL');
  console.log('-'.repeat(100));
  for (const r of results) {
    console.log(
      pad(r.gate, 13) + pad(r.hard ? 'HARD' : 'soft', 7) +
      pad(r.ok ? 'PASS' : 'FAIL', 8) + r.detail
    );
  }

  const hardFails = results.filter((r) => r.hard && !r.ok);
  const softFails = results.filter((r) => !r.hard && !r.ok);
  console.log('');
  console.log(`[readiness] HARD ${results.filter(r => r.hard && r.ok).length}/${results.filter(r => r.hard).length} passed · soft warnings: ${softFails.length}`);

  if (JSON_OUT) {
    writeFileSync(JSON_OUT, JSON.stringify({ base: BASE, results }, null, 2));
    console.log(`[readiness] wrote ${JSON_OUT}`);
  }

  if (hardFails.length) {
    console.error(`\n[readiness] NOT READY — ${hardFails.length} hard gate(s) failed:`);
    for (const f of hardFails) console.error(`  - ${f.gate}: ${f.detail}`);
    process.exit(1);
  }
  console.log('\n[readiness] all hard gates passed');
  process.exit(0);
}

main().catch((e) => {
  console.error('[readiness] crashed:', e);
  process.exit(2);
});