#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
SCRIPT="$ROOT_DIR/scripts/verify-aug1-production-api-readonly.sh"
DEV_SETUP="$ROOT_DIR/docs/DEV_SETUP.md"
AUTH_CONTROLLER="$ROOT_DIR/backend/ruoyi-admin/src/main/java/org/dromara/web/controller/AuthController.java"
MOBILE_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrMobileController.java"
KNOWLEDGE_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/knowledge/controller/AihrKnowledgeQueryController.java"
SOP_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java"
PRACTICE_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrPracticeController.java"
AGENT_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/agent/AihrAgentController.java"
DIRECT_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/direct/AihrDirectController.java"
SPEECH_CONTROLLER="$ROOT_DIR/backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSpeechController.java"

bash -n "$SCRIPT"

probe_count="$(grep -Ec '^(public|auth|method)_[^|]+\|/[^|]+\|[0-9]+$' "$SCRIPT")"
[[ "$probe_count" -eq 20 ]]
[[ "$(grep -Ec '^public_[^|]+\|/[^|]+\|200$' "$SCRIPT")" -eq 1 ]]
[[ "$(grep -Ec '^auth_[^|]+\|/[^|]+\|401$' "$SCRIPT")" -eq 6 ]]
[[ "$(grep -Ec '^method_[^|]+\|/[^|]+\|405$' "$SCRIPT")" -eq 13 ]]

grep -Fq 'side_effects=GET-only' "$SCRIPT"
grep -Fq 'sms-code endpoint intentionally excluded' "$SCRIPT"
grep -Fq './scripts/verify-aug1-production-api-readonly.sh' "$DEV_SETUP"

grep -Fq '@PostMapping("/mobile/sms-login")' "$AUTH_CONTROLLER"
grep -Fq '@GetMapping("/home/{role}")' "$MOBILE_CONTROLLER"
grep -Fq '@GetMapping("/me")' "$MOBILE_CONTROLLER"
grep -Fq '@PostMapping("/query")' "$KNOWLEDGE_CONTROLLER"
grep -Fq '@PostMapping(value = "/query-media"' "$KNOWLEDGE_CONTROLLER"
grep -Fq '@PostMapping("/resources/{attachmentId}/download-link")' "$KNOWLEDGE_CONTROLLER"
grep -Fq '@GetMapping("/position-sop")' "$SOP_CONTROLLER"
grep -Fq '@PostMapping("/answer-feedback")' "$SOP_CONTROLLER"
grep -Fq '@GetMapping("/answer-feedback")' "$SOP_CONTROLLER"
grep -Fq '@PostMapping("/summary-card")' "$SOP_CONTROLLER"
grep -Fq '@GetMapping("/scenarios")' "$PRACTICE_CONTROLLER"
grep -Fq '@PostMapping("/start")' "$PRACTICE_CONTROLLER"
grep -Fq '@PostMapping("/turn")' "$PRACTICE_CONTROLLER"
grep -Fq '@PostMapping("/finish")' "$PRACTICE_CONTROLLER"
grep -Fq '@PostMapping("/messages")' "$AGENT_CONTROLLER"
grep -Fq '@PostMapping(value = "/messages/media"' "$AGENT_CONTROLLER"
grep -Fq '@GetMapping("/channels")' "$DIRECT_CONTROLLER"
grep -Fq '@GetMapping("/mine")' "$DIRECT_CONTROLLER"
grep -Fq '@PostMapping("/feedback")' "$DIRECT_CONTROLLER"
grep -Fq '@PostMapping(value = "/asr"' "$SPEECH_CONTROLLER"
grep -Fq '@PostMapping("/tts")' "$SPEECH_CONTROLLER"

for forbidden in \
  'curl -X' \
  '--request' \
  '--data' \
  '--form' \
  'phonenumber=' \
  'Authorization:' \
  '/resource/sms/code'; do
  if grep -Fq -- "$forbidden" "$SCRIPT"; then
    echo "FAIL: read-only production API verifier contains forbidden request material: $forbidden" >&2
    exit 1
  fi
done

echo 'PASS: August 1 production API verifier is GET-only and excludes SMS/login side effects'