// Checks existing synthetic credentials only; never resets passwords or creates users.
import fs from 'node:fs/promises';
import assert from 'node:assert/strict';
const reports=[];
// Existing integrated evaluation entry: verify all four roles without credentials.
for(const role of ['preparador','validador','tecnico','verificador']){
    const cookies=new Map();
    async function get(path,method='GET',body){
        const r=await fetch('http://127.0.0.1:8002'+path,{method,redirect:'manual',headers:{Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),...(body?{'Content-Type':'application/x-www-form-urlencoded'}:{})},...(body?{body:new URLSearchParams(body)}:{})});
        for(const c of r.headers.getSetCookie()){const pair=c.split(';',1)[0],i=pair.indexOf('=');cookies.set(pair.slice(0,i),pair.slice(i+1));}
        return {status:r.status,text:await r.text(),location:r.headers.get('location')};
    }
    const landing=await get('/avaliar');assert.equal(landing.status,200);
    const token=landing.text.match(/name="_token" value="([^"]+)"/)?.[1];assert(token);
    const entry=await get('/avaliar/entrar','POST',{role,_token:token});assert.equal(entry.status,302);assert.equal(new URL(entry.location, 'http://127.0.0.1:8002').pathname,'/','evaluation redirect');
    assert.equal((await get('/')).status,200);
    const session=JSON.parse((await get('/api/session')).text);assert(session.user);assert(session.context);
    assert.equal((await get('/api/workshop')).status,200);
    const logout=await fetch('http://127.0.0.1:8002/api/logout',{method:'POST',headers:{Accept:'application/json',Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),'X-CSRF-TOKEN':session.csrf}});assert.equal(logout.status,200);
    reports.push({host:'sgf-product',role,password_required:false,authorised_consultation:true,logout:true});
}
for(const mode of ['compras','sgf']){
    const fixture=JSON.parse(await fs.readFile(`C:/laragon/data/sgf-tempo/secrets/payables-demo-${mode}-access.json`,'utf8'));
    const base=`http://127.0.0.1:${mode==='compras'?8005:8006}`;
    for(const [role,account] of Object.entries(fixture.accounts)){
        const cookies=new Map();let csrf='',context='';
        async function request(path,method='GET',body){
            const r=await fetch(base+path,{method,redirect:'manual',headers:{Accept:'application/json','Content-Type':'application/json',Cookie:[...cookies].map(([k,v])=>`${k}=${v}`).join('; '),'X-CSRF-TOKEN':csrf,'X-XSRF-TOKEN':decodeURIComponent(cookies.get('XSRF-TOKEN')??''),'X-SGF-Context':context},...(body?{body:JSON.stringify(body)}:{})});
            for(const c of r.headers.getSetCookie()){const pair=c.split(';',1)[0],i=pair.indexOf('=');cookies.set(pair.slice(0,i),pair.slice(i+1));}
            const text=await r.text();let data={};try{data=JSON.parse(text);}catch{}
            if(data.csrf)csrf=data.csrf;if(data.context?.token)context=data.context.token;
            return {status:r.status,data};
        }
        assert.equal((await request(mode==='compras'?'/login':'/api/session')).status,200);
        const login=await request(mode==='compras'?'/login':'/api/login','POST',{email:account.email,password:account.password});assert.equal(login.status,200,mode+' '+role+' existing login');
        if(mode==='sgf')assert.equal((await request('/api/context','POST',fixture.scope)).status,200);
        assert.equal((await request('/api/supplier-payables')).status,200);
        assert.equal((await request(mode==='compras'?'/logout':'/api/logout','POST',{})).status,mode==='compras'?204:200);
        reports.push({host:mode,role,existing_password_accepted:true,authorised_consultation:true,logout:true});
    }
}
await fs.writeFile('docs/proofs/access-recovery.json',JSON.stringify({checked_at:new Date().toISOString(),results:reports,accounts_created:0,passwords_changed:0,permissions_changed:0,business_commands:0,visual_review:false},null,2)+'\n');
console.log('Integrated password-free SGF entry passed for four roles; six existing payables credentials accepted by their correct hosts. Consultation and logout passed.');