#!/usr/bin/env bash
# Phase 01 verification script.
# Confirms the three-repo scaffold exists under the continuous-intelligence
# Gitea org and that the Phase 01 visible artifacts (placeholder index.html on
# acdl-evidence; qa + prod branches on acdl-contracts) are present.
#
# Usage: ACDL_GITEA_TOKEN=<token> scripts/verify_phase01.sh
# Exit codes: 0 = all checks passed; 1 = one or more checks failed.

set -euo pipefail

GITEA_HOST="${GITEA_HOST:-https://git.cloudinit.dev}"
ORG="continuous-intelligence"
TOKEN="${ACDL_GITEA_TOKEN:-}"

fail_count=0
note() { printf '  [%s] %s\n' "$1" "$2"; }
pass() { note "PASS" "$1"; }
fail() { note "FAIL" "$1"; fail_count=$((fail_count + 1)); }
warn() { printf '  [WARN] %s\n' "$1" >&2; }

echo "== Phase 01 verification =="
echo "Host:  $GITEA_HOST"
echo "Org:   $ORG"
if [ -n "$TOKEN" ]; then
  echo "Token: <set, ${#TOKEN} chars>"
else
  echo "Token: <unset>"
fi
echo

# --- Check 1: acdl-contracts repo exists ---
echo "-- Check 1: acdl-contracts repo exists --"
status=$(curl -sS -o /tmp/p01_contracts.json -w "%{http_code}" \
  -H "Authorization: token ${TOKEN}" \
  "${GITEA_HOST}/api/v1/repos/${ORG}/acdl-contracts")
if [ "$status" = "200" ]; then
  default_branch=$(python3 -c "import json; print(json.load(open('/tmp/p01_contracts.json')).get('default_branch','?'))")
  pass "acdl-contracts exists (default_branch=${default_branch})"
else
  fail "acdl-contracts GET returned HTTP ${status}"
fi

# --- Check 2: acdl-evidence repo exists ---
echo "-- Check 2: acdl-evidence repo exists --"
status=$(curl -sS -o /tmp/p01_evidence.json -w "%{http_code}" \
  -H "Authorization: token ${TOKEN}" \
  "${GITEA_HOST}/api/v1/repos/${ORG}/acdl-evidence")
if [ "$status" = "200" ]; then
  default_branch=$(python3 -c "import json; print(json.load(open('/tmp/p01_evidence.json')).get('default_branch','?'))")
  pass "acdl-evidence exists (default_branch=${default_branch})"
else
  fail "acdl-evidence GET returned HTTP ${status}"
fi

# --- Check 3: acdl-evidence raw index.html returns 200 (Pages substitute per D-012/D-016) ---
# acdl-evidence is public per gitea_setup.sh step 2b, so the raw URL should
# work without auth. We also try with the auth header as a fallback so the
# check does not spuriously fail if the repo visibility was reset.
echo "-- Check 3: acdl-evidence raw index.html returns 200 --"
index_url="${GITEA_HOST}/${ORG}/acdl-evidence/raw/branch/main/index.html"
status=$(curl -sS -o /tmp/p01_index.html -w "%{http_code}" "${index_url}")
if [ "$status" != "200" ] && [ -n "$TOKEN" ]; then
  warn "raw URL returned ${status} unauth; retrying with Authorization header"
  status=$(curl -sS -o /tmp/p01_index.html -w "%{http_code}" \
    -H "Authorization: token ${TOKEN}" "${index_url}")
fi
if [ "$status" = "200" ]; then
  body_size=$(wc -c < /tmp/p01_index.html)
  if grep -q "ACDL Evidence" /tmp/p01_index.html; then
    pass "raw index.html returns 200 with placeholder body (${body_size} bytes)"
  else
    fail "raw index.html returns 200 but body does not contain 'ACDL Evidence' marker"
  fi
else
  fail "GET ${index_url} returned HTTP ${status}"
fi

# --- Check 4: qa + prod branches exist on acdl-contracts ---
echo "-- Check 4: qa + prod branches exist on acdl-contracts --"
status=$(curl -sS -o /tmp/p01_branches.json -w "%{http_code}" \
  -H "Authorization: token ${TOKEN}" \
  "${GITEA_HOST}/api/v1/repos/${ORG}/acdl-contracts/branches?limit=50")
if [ "$status" != "200" ]; then
  fail "list branches on acdl-contracts returned HTTP ${status}"
else
  for want in qa prod; do
    if python3 -c "
import json, sys
branches = json.load(open('/tmp/p01_branches.json'))
names = [b.get('name', '') for b in branches]
sys.exit(0 if '${want}' in names else 1)
"; then
      pass "branch '${want}' exists on acdl-contracts"
    else
      fail "branch '${want}' missing on acdl-contracts"
    fi
  done
fi

echo
echo "== Summary =="
if [ "$fail_count" -eq 0 ]; then
  echo "Phase 01 verification PASSED (all checks ok)"
  exit 0
else
  echo "Phase 01 verification FAILED (${fail_count} check(s) failed)"
  exit 1
fi