#!/usr/bin/env node
import { execFileSync } from 'node:child_process';
import crypto from 'node:crypto';
import fs from 'node:fs';
import path from 'node:path';

const root = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..');
const args = new Map(process.argv.slice(2).map((arg) => {
  const [key, ...rest] = arg.replace(/^--/, '').split('=');
  return [key, rest.join('=') || 'true'];
}));

const baseUrl = args.get('base-url') || process.env.AIHR_BASE_URL || 'https://wygj-api.localhost';
const parsedBaseUrl = new URL(baseUrl);
if (parsedBaseUrl.protocol === 'https:' && parsedBaseUrl.hostname.endsWith('.localhost') && !process.env.NODE_EXTRA_CA_CERTS) {
  // ponytail: local portless CA is not visible to Node fetch; only relax TLS for .localhost dev verification.
  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
}
const file = path.resolve(root, args.get('file') || 'docs/20260708/发布会演示候选题单.md');
const prefixes = (args.get('prefix') || 'Q').split(',').map((item) => item.trim()).filter(Boolean);
const limit = Number(args.get('limit') || 0);

function readEnv(filePath) {
  const env = {};
  const text = fs.readFileSync(filePath, 'utf8');
  for (const line of text.split(/\r?\n/)) {
    const match = line.match(/^\s*([A-Z0-9_]+)\s*=\s*(.+?)\s*$/);
    if (!match) continue;
    env[match[1]] = match[2].replace(/^['"]|['"]$/g, '');
  }
  return env;
}

function pem(label, body) {
  return `-----BEGIN ${label}-----\n${body.match(/.{1,64}/g).join('\n')}\n-----END ${label}-----`;
}

const frontendEnv = readEnv(path.join(root, 'frontend/.env.development'));
const clientid = process.env.AIHR_CLIENT_ID || frontendEnv.VITE_APP_CLIENT_ID;
const requestPublicKey = pem('PUBLIC KEY', frontendEnv.VITE_APP_RSA_PUBLIC_KEY);
const responsePrivateKey = pem('PRIVATE KEY', frontendEnv.VITE_APP_RSA_PRIVATE_KEY);

function aesEncrypt(text, keyText) {
  const cipher = crypto.createCipheriv('aes-256-ecb', Buffer.from(keyText, 'utf8'), null);
  cipher.setAutoPadding(true);
  return Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]).toString('base64');
}

function aesDecrypt(base64Text, key) {
  const decipher = crypto.createDecipheriv('aes-256-ecb', key, null);
  decipher.setAutoPadding(true);
  return Buffer.concat([decipher.update(Buffer.from(base64Text, 'base64')), decipher.final()]).toString('utf8');
}

function encryptPayload(payload) {
  const keyText = crypto.randomBytes(24).toString('base64').slice(0, 32);
  const encryptedBody = aesEncrypt(JSON.stringify(payload), keyText);
  const keyBase64 = Buffer.from(keyText, 'utf8').toString('base64');
  const encryptedKey = crypto.publicEncrypt(
    { key: requestPublicKey, padding: crypto.constants.RSA_PKCS1_PADDING },
    Buffer.from(keyBase64, 'utf8')
  ).toString('base64');
  return { encryptedBody, encryptedKey };
}

function decryptResponse(text, encryptedKey) {
  if (!encryptedKey) return JSON.parse(text);
  const keyBase64 = crypto.privateDecrypt(
    { key: responsePrivateKey, padding: crypto.constants.RSA_PKCS1_PADDING },
    Buffer.from(encryptedKey, 'base64')
  ).toString('utf8');
  return JSON.parse(aesDecrypt(text, Buffer.from(keyBase64, 'base64')));
}

async function request(method, endpoint, body, token, encrypted = false) {
  const headers = { clientid, 'Content-Language': 'zh_CN' };
  let payload;
  if (token) headers.Authorization = `Bearer ${token}`;
  if (body !== undefined) {
    headers['Content-Type'] = 'application/json;charset=utf-8';
    if (encrypted) {
      const encryptedPayload = encryptPayload(body);
      payload = encryptedPayload.encryptedBody;
      headers['encrypt-key'] = encryptedPayload.encryptedKey;
    } else {
      payload = JSON.stringify(body);
    }
  }
  const controller = new AbortController();
  const timeout = setTimeout(() => controller.abort(), 70000);
  try {
    const response = await fetch(`${baseUrl}${endpoint}`, { method, headers, body: payload, signal: controller.signal });
    const text = await response.text();
    const data = encrypted ? decryptResponse(text, response.headers.get('encrypt-key')) : JSON.parse(text);
    return { status: response.status, data };
  } finally {
    clearTimeout(timeout);
  }
}

async function login() {
  if (process.env.AIHR_VERIFY_TOKEN) return process.env.AIHR_VERIFY_TOKEN;
  const codeResponse = await request('GET', '/auth/code');
  const uuid = codeResponse.data?.data?.uuid;
  if (!uuid) throw new Error('captcha uuid missing');
  const redisKey = `global:captcha_codes:${uuid}`;
  const redisValue = execFileSync(
    'docker',
    ['exec', 'wygj-redis', 'redis-cli', '-a', 'ruoyi123', '--raw', 'get', redisKey],
    { encoding: 'utf8' }
  ).trim().split('\n').pop().replace(/^"|"$/g, '');
  const loginResponse = await request('POST', '/auth/login', {
    tenantId: '000000',
    username: process.env.AIHR_VERIFY_USER || 'admin',
    password: process.env.AIHR_VERIFY_PASSWORD || 'admin123',
    rememberMe: false,
    code: redisValue,
    uuid,
    clientId: clientid,
    grantType: 'password'
  }, undefined, true);
  const token = loginResponse.data?.data?.access_token;
  if (!token) throw new Error(`login failed: ${loginResponse.data?.msg || loginResponse.status}`);
  return token;
}

function parseQuestions(markdown) {
  const rows = [];
  for (const line of markdown.split(/\r?\n/)) {
    if (!line.startsWith('|')) continue;
    const cells = line.split('|').slice(1, -1).map((cell) => cell.trim());
    if (cells.length < 5 || !/^[A-Z]\d+$/u.test(cells[0])) continue;
    if (!prefixes.some((prefix) => cells[0].startsWith(prefix))) continue;
    rows.push({
      id: cells[0],
      scene: cells[1],
      question: cells[2],
      sources: [...cells[3].matchAll(/`([^`]+)`/g)].map((match) => match[1])
    });
  }
  return limit > 0 ? rows.slice(0, limit) : rows;
}

function hasExpectedSource(result, expectedSources) {
  if (!expectedSources.length) return true;
  const haystack = [
    ...(result.docs || []).map((item) => item.title || item.docName || item.name || ''),
    ...(result.snippets || []).map((item) => item.title || item.docName || item.name || '')
  ].join('\n');
  return expectedSources.some((source) => haystack.includes(source.replace(/\s+/g, ' ').trim()));
}

const questions = parseQuestions(fs.readFileSync(file, 'utf8'));
if (!questions.length) {
  console.error(`FAIL: no questions found in ${file} for prefix ${prefixes.join(',')}`);
  process.exit(1);
}

const token = await login();
const vector = await request('GET', '/api/knowledge/doc/vector-index-status', undefined, token);
const vectorStatus = vector.data?.data;
if (!vectorStatus?.matched) {
  console.error(`FAIL: vector index mismatch: ${vectorStatus?.message || 'unknown'}`);
  process.exit(1);
}

let failed = 0;
let warned = 0;
console.log(`VERIFY ${questions.length} question(s), prefix=${prefixes.join(',')}, base=${baseUrl}`);
for (const item of questions) {
  const response = await request('POST', '/api/knowledge/search', {
    queryText: item.question,
    category: 'sop',
    position: '生活顾问',
    source: 'verify_demo_questions'
  }, token);
  const data = response.data?.data || {};
  const docs = data.docs || [];
  const snippets = data.snippets || [];
  const ok = response.status === 200 && response.data?.code === 200 && Boolean((data.answer || '').trim()) && (docs.length || snippets.length);
  const sourceOk = hasExpectedSource(data, item.sources);
  if (!ok) {
    failed += 1;
    console.log(`FAIL ${item.id} ${item.scene}: ${item.question}`);
    continue;
  }
  if (!sourceOk) {
    warned += 1;
    console.log(`WARN ${item.id} ${item.scene}: answered, but top evidence missed listed source`);
  } else {
    console.log(`OK   ${item.id} ${item.scene}`);
  }
}

console.log(`SUMMARY ok=${questions.length - failed}/${questions.length} warnings=${warned} vector=${vectorStatus.embeddedFragments}/${vectorStatus.fragments}`);
process.exit(failed ? 1 : 0);