import assert from 'node:assert/strict';
import fs from 'node:fs/promises';

const base = 'http://127.0.0.1:8002';
const cookies = new Map();
let csrf = '', context = '';
async function request(path, method = 'GET', body) {
    const response = await fetch(base + path, {method, redirect: 'manual', headers: {
        Accept: 'application/json', Cookie: [...cookies].map(([k,v]) => `${k}=${v}`).join('; '),
        'Content-Type': 'application/x-www-form-urlencoded', 'X-CSRF-TOKEN': csrf, 'X-SGF-Context': context,
    }, ...(body ? {body: new URLSearchParams(body)} : {})});
    for (const cookie of response.headers.getSetCookie()) {
        const pair = cookie.split(';', 1)[0], index = pair.indexOf('=');
        cookies.set(pair.slice(0, index), pair.slice(index + 1));
    }
    return {status: response.status, text: await response.text()};
}
async function enter() {
    const page = await request('/avaliar');
    assert.equal(page.status, 200);
    csrf = page.text.match(/name="_token" value="([^"]+)"/)[1];
    assert.equal((await request('/avaliar/entrar', 'POST', {role: 'proprietario', _token: csrf})).status, 302);
    const session = JSON.parse((await request('/api/session')).text);
    assert.equal(session.user.email, 'proprietario-avaliacao@example.test');
    assert(session.context);
    csrf = session.csrf; context = session.context.token;
    return session;
}
const first = await enter();
const modules = ['a/clients','a/services','a/service_drafts','a/billing_drafts','workshop','workshop-billing',
    'workshop-corrections','direct-costs','industrial-costs','industrial-budgets','service-invoices',
    'service-receivables','service-fiscal','catalogue-accounting','document-preview/model','accesses'];
for (const module of modules) assert.equal((await request('/api/' + module)).status, 200, module);
for (const permission of ['workshop.record', 'workshop.verify', 'direct_costs.prepare', 'direct_costs.validate',
    'industrial_costs.prepare', 'industrial_costs.validate', 'catalogue_accounting.propose', 'catalogue_accounting.approve']) {
    assert(first.context.grants.some(g => g.permission === permission), permission);
}
assert.equal((await request('/avaliar/entrar', 'POST', {role: 'proprietario', user_id: '1', _token: csrf})).status, 422);
const second = await enter();
assert.equal(second.user.id, first.user.id);
assert.deepEqual(second.context.grants, first.context.grants, 'Re-entry must not duplicate grants');
await fs.writeFile('docs/proofs/local-owner-access.json', JSON.stringify({checked_at: new Date().toISOString(),
    instance: base, synthetic_owner: true, consulted_modules: modules, grants: second.context.grants.length,
    repeated_entry_stable: true, arbitrary_user_refused: true, business_commands: 0, real_accounts_changed: false,
    process_separation_rules_removed: false, ssh_used: false, visual_review: false}, null, 2) + '\n');
console.log('Local owner entry, 16 module queries, combined permissions and repeat entry passed.');