#!/usr/bin/env bash
# scripts/verify_phase12.sh - verify Phase 12 (nfr-harden-and-simplify).
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

fail() { echo "FAIL: $*" >&2; exit 1; }

echo "=== Phase 12 verification ==="

# 1. Script consolidation (D-048)
[ -f scripts/run_platform.sh ] || fail "scripts/run_platform.sh missing"
[ -x scripts/run_platform.sh ] || fail "scripts/run_platform.sh not executable"
[ ! -f scripts/run_spike_e2e.sh ] || fail "scripts/run_spike_e2e.sh should be deleted"
[ ! -f scripts/run_spike_plan.sh ] || fail "scripts/run_spike_plan.sh should be deleted"
grep -q "set -euo pipefail" scripts/run_platform.sh || fail "run_platform.sh: no 'set -euo pipefail'"
grep -q -- "--plan-only" scripts/run_platform.sh || fail "run_platform.sh: no --plan-only flag"
grep -q "PLATFORM E2E OK" scripts/run_platform.sh || fail "run_platform.sh: no PLATFORM E2E OK banner"
grep -q "PLATFORM PLAN OK" scripts/run_platform.sh || fail "run_platform.sh: no PLATFORM PLAN OK banner"
grep -q "run_platform.sh" README.md || fail "README.md: no run_platform.sh reference"
! grep -q "run_spike_e2e.sh" README.md || fail "README.md: stale run_spike_e2e.sh reference"
! grep -q "run_spike_plan.sh" README.md || fail "README.md: stale run_spike_plan.sh reference"
echo "Script consolidation (D-048): OK"

# 2. IAM policy expansion (ECS + ECR + ELB + IAM + EC2)
python3 -c "import json; json.load(open('terraform/bootstrap/spike_runner_policy.json'))" || fail "spike_runner_policy.json: invalid JSON"
grep -q "ecs:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no ECS permissions"
grep -q "ecr:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no ECR permissions"
grep -q "elasticloadbalancing:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no ELB permissions"
grep -q "iam:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no IAM permissions"
grep -q "ec2:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no EC2 permissions"
grep -q "DenyEverythingElse" terraform/bootstrap/spike_runner_policy.json || fail "policy: DenyEverythingElse removed"
echo "IAM policy expansion: OK (ECS + ECR + ELB + IAM + EC2 + DenyEverythingElse)"

# 3. Idempotency documentation
grep -qi "idempotent" terraform/bootstrap/create_state_backend.py || fail "create_state_backend.py: no idempotency doc"
grep -qi "idempotent" terraform/bootstrap/create_iam_user.py || fail "create_iam_user.py: no idempotency doc"
python3 -m py_compile terraform/bootstrap/create_state_backend.py terraform/bootstrap/create_iam_user.py || fail "bootstrap scripts: py_compile failed"
echo "Idempotency documentation: OK"

# 4. P1-1 redaction (no live AWS key IDs in .ciagent/)
if grep -rn "AKIAYOZHMKZ7RK26N66W\|AKIAYOZHMKZ772SINHFX" .ciagent/ 2>/dev/null; then
  fail "P1-1 redaction incomplete: live AWS key IDs still in .ciagent/"
fi
echo "P1-1 redaction: OK (no live AWS key IDs in .ciagent/)"

# 5. P1-B stale path fix
! grep -q "platform/registry" .ciagent/PERSONAS.md || fail "PERSONAS.md: stale platform/registry path"
grep -q "modules-ir/registry.json" .ciagent/PERSONAS.md || fail "PERSONAS.md: registry path not updated to modules-ir/registry.json"
echo "P1-B stale path: OK (PERSONAS.md platform/registry -> modules-ir/registry.json)"

# 6. run_platform.sh syntax + plan-only smoke (may fail at AWS auth if no .env.secrets — that's OK)
bash -n scripts/run_platform.sh || fail "run_platform.sh: syntax error"
echo "run_platform.sh syntax: OK"

# 7. .ciagent/ consistency
grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
echo ".ciagent/ consistency: OK"

echo ""
echo "=== Phase 12: VERIFIED ==="
echo "run_platform.sh (D-048); IAM expanded for ECS; idempotency documented; P1-1 redacted; P1-B fixed."
exit 0