#!/usr/bin/env node

const fs = require('fs');
const path = require('path');

const openHubRoot =
  process.env.OPENHUB_RESEARCH_ROOT || '/tmp/mnote-openhub-research/OpenHub';
const backendRoot = path.join(openHubRoot, 'smart-query-backend');

function read(relativePath) {
  return fs.readFileSync(path.join(backendRoot, relativePath), 'utf8');
}

function assertCheck(name, passed) {
  if (!passed) failures.push(name);
}

function includesAll(source, needles) {
  return needles.every((needle) => source.includes(needle));
}

const failures = [];

const mnoteScope = read('app/core/mnote_scope.py');
const auth = read('app/core/auth.py');
const query = read('app/api/query.py');
const session = read('app/api/session.py');
const stream = read('app/services/stream.py');

const requiredHeaders = [
  'X-MNote-User-Key',
  'X-MNote-Workspace-Key',
  'X-MNote-Session-Scope',
  'X-MNote-Root-Uri',
  'X-MNote-Page-Resource-Id',
  'X-MNote-Tool-Permission-Scope',
  'X-MNote-WeKnora-Tool-Scope',
];

assertCheck(
  'mnote scope helper exists with all controlled headers',
  includesAll(mnoteScope, [
    'MNOTE_HOST_TRUTH = "mnote_controlled_headers"',
    'def derive_mnote_user',
    'def resolve_user_workspace',
    'def get_mnote_scope_metadata',
    ...requiredHeaders,
  ])
);

assertCheck(
  'derived user is stable and not a shared singleton',
  includesAll(mnoteScope, [
    'def _stable_openhub_user_id',
    'mnote_openhub_user_id',
    'user_key',
    'workspace_key',
    '"openhub_user_id"',
    '"openhub_username"',
  ]) && !mnoteScope.includes('mnote_shared_user')
);

assertCheck(
  'session and workspace scope are derived from MNote scope',
  includesAll(mnoteScope, [
    'def _stable_openhub_session_id',
    'mnote_openhub_session',
    'openhub_workspace_scope',
    'session_scope',
    'root_uri',
    'workspace_path',
    '_root_uri_to_workspace_path',
  ])
);

assertCheck(
  'tool and weknora scopes are retained as MNote scope metadata',
  includesAll(mnoteScope, [
    'tool_permission_scope',
    'weknora_tool_scope',
    '_parse_scope_header',
    '"mnote_scope"',
    '"source_headers"',
  ])
);

assertCheck(
  'MNote host mode rejects frontend JWT/localStorage truth',
  includesAll(mnoteScope, [
    'REJECTED_MNOTE_HOST_TRUTHS',
    'localStorage',
    'OpenHub JWT',
    'frontend JWT',
  ]) &&
    auth.includes('derive_mnote_user(request)') &&
    auth.includes('HTTPBearer(auto_error=False)') &&
    auth.indexOf('derive_mnote_user(request)') < auth.indexOf('validate_token(token)')
);

assertCheck(
  'query/session entries consume derived workspace and scope',
  query.includes('resolve_user_workspace(current_user)') &&
    query.includes('not current_user.get("mnote_host_mode")') &&
    query.includes('mnote_scope=get_mnote_scope_metadata(current_user)') &&
    session.includes('resolve_user_workspace(current_user)') &&
    session.includes('mnote_scope=get_mnote_scope_metadata(current_user)')
);

assertCheck(
  'stream persists MNote scope metadata with user message',
  includesAll(stream, [
    'mnote_scope: Optional[dict] = None',
    'metadata["mnote_scope"] = mnote_scope',
    'database.save_session',
    'user_id',
    'workspace_path',
    'not mnote_scope',
  ])
);

if (failures.length) {
  console.error('OpenHub MNote scope bridge static smoke failed:');
  for (const failure of failures) console.error(`- ${failure}`);
  process.exit(1);
}

console.log('OpenHub MNote scope bridge static smoke passed.');