#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
CLIENT_DIR="$ROOT_DIR/client"
PUBLIC_BASE_URL="${LIVE_SMOKE_BASE_URL:-https://oa.hyinda.com}"
REPORT_DIR="${OAFRONT3_PC_REPORT_DIR:-$ROOT_DIR/artifacts/qa-flow/oafront3-pc-readonly-visual-$(date +%Y%m%d-%H%M%S)}"
OUTPUT_DIR="${OAFRONT3_PC_OUTPUT_DIR:-$ROOT_DIR/output/playwright/oafront3-pc-readonly}"

load_default_env() {
  local env_file="${OAFRONT3_ENV_FILE:-$HOME/.hyb-oa/live-smoke.env}"
  if [[ "${OAFRONT3_SKIP_ENV_FILE:-0}" == "1" || ! -f "$env_file" ]]; then
    return 0
  fi

  set -a
  # shellcheck disable=SC1090
  source "$env_file"
  set +a
  PUBLIC_BASE_URL="${LIVE_SMOKE_BASE_URL:-$PUBLIC_BASE_URL}"
  echo "[oafront3] loaded masked live smoke env file"
}

write_fallback_summary() {
  local exit_code="$?"
  if [[ -f "$REPORT_DIR/summary.json" ]]; then
    return "$exit_code"
  fi

  mkdir -p "$REPORT_DIR"
  QA_REPORT_DIR="$REPORT_DIR" \
    QA_ISSUE_ID="OAFRONT3-1" \
    QA_BASE_URL="$PUBLIC_BASE_URL" \
    QA_MODE="pc-readonly-visual-evidence" \
    QA_STATUS="FAIL" \
    QA_SUMMARY_NOTES="Playwright 未生成 summary.json；查看脚本日志和 playwright-report。" \
    node "$ROOT_DIR/scripts/qa/write-qa-summary.mjs" >/dev/null 2>&1 || true
  return "$exit_code"
}

run_privacy_smoke() {
  local sensitive_pattern='(["'\''"]?(WECOM_[A-Z0-9_]*(SECRET|TOKEN)|[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|ENCODING_AES_KEY|ENCODINGAESKEY|CORP_SECRET|ACCESS_TOKEN)[A-Z0-9_]*)["'\''"]?[[:space:]]*[:=][[:space:]]*["'\''"]?[A-Za-z0-9._:/+=-]{8,}["'\''"]?)|Authorization:[[:space:]]*Bearer[[:space:]]+[A-Za-z0-9._-]{8,}|access_token=[A-Za-z0-9._-]{8,}|1[3-9][0-9]{9}|[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}|-----BEGIN|BEGIN [A-Z ]*KEY|"((token|secret|password|EncodingAESKey|encodingAESKey|sp_no|spNo|template_id|templateId|userid|userId|external_userid|externalUserId))"[[:space:]]*:[[:space:]]*"[^"*]{8,}"|\b20[0-9]{12,}\b|"(raw|rawPayload|raw_payload|payload|xml|ciphertext|Encrypt|formValue|formValues|attachments|comments)"[[:space:]]*:'
  local matches
  matches="$(grep -RInE "$sensitive_pattern" "$REPORT_DIR" || true)"
  if [[ -n "$matches" ]]; then
    printf '%s\n' "$matches" >&2
    echo "[oafront3][FAIL] report privacy smoke matched sensitive pattern" >&2
    return 1
  fi
  echo "[oafront3][PASS] report privacy smoke"
}

trap write_fallback_summary EXIT

load_default_env
mkdir -p "$REPORT_DIR" "$OUTPUT_DIR"

echo ">>> [oafront3] PC readonly visual evidence base=$PUBLIC_BASE_URL"
(
  cd "$CLIENT_DIR"
  E2E_MODE=live \
    LIVE_SMOKE_BASE_URL="$PUBLIC_BASE_URL" \
    OAFRONT3_PC_REPORT_DIR="$REPORT_DIR" \
    OAFRONT3_PC_OUTPUT_DIR="$OUTPUT_DIR" \
    npx playwright test tests/e2e/oafront3-pc-readonly-visual.spec.ts --workers=1 --reporter=list
)

run_privacy_smoke
echo "[oafront3] summary=$REPORT_DIR/summary.json"