import { writeFileSync, unlinkSync } from 'node:fs'
import { spawnSync } from 'node:child_process'
import { dirname, join } from 'node:path'
import { fileURLToPath } from 'node:url'

const root = join(dirname(fileURLToPath(import.meta.url)), '..')
const src = join(root, 'src', '_pure-check.ts')

writeFileSync(
	src,
	`
import { resolveAuthMode, resolveMetaIntegration, resolveSystemUserSecret } from './accounts.ts'
import { GRAPH_API_VERSION, buildMetaConnectUrl, inferRequiredScopes, systemUserSecretUrl } from './scopes.ts'
import { boundedLimit, stripSecrets } from './validation.ts'

function assert(cond: unknown, msg: string) {
	if (!cond) throw new Error(msg)
}

assert(resolveMetaIntegration() === 'meta', 'default integration')
assert(resolveMetaIntegration({ account: 'work' }) === 'meta-work', 'account alias')
assert(resolveMetaIntegration({ integration: 'meta-personal' }) === 'meta-personal', 'explicit integration')
assert(resolveSystemUserSecret() === 'metaSystemUserToken', 'default secret')
assert(resolveSystemUserSecret({ account: 'work' }) === 'metaSystemUserToken-work', 'secret alias')
assert(resolveAuthMode({ tokenSecret: 'metaSystemUserToken' }) === 'system-user', 'tokenSecret implies system-user')
assert(resolveAuthMode({}) === 'oauth', 'default oauth')

const pageWrite = inferRequiredScopes('POST', '/123/feed')
assert(pageWrite.scopes.includes('pages_manage_posts'), 'page publish scope')
const waSend = inferRequiredScopes('POST', '/123456789/messages')
assert(waSend.scopes.includes('whatsapp_business_messaging'), 'wa send scope')
const igPub = inferRequiredScopes('POST', '/1784/media_publish')
assert(igPub.scopes.includes('instagram_content_publish'), 'ig publish scope')

const connect = buildMetaConnectUrl({ provider: 'meta-work', scopes: ['public_profile'] })
assert(connect.includes('provider=meta-work'), 'connect provider')
assert(connect.includes('www.facebook.com'), 'authorize host')
assert(connect.includes('graph.facebook.com'), 'token host')
assert(!connect.toLowerCase().includes('kent'), 'no personal alias')
assert(GRAPH_API_VERSION === 'v26.0', 'graph version')

const secretUrl = systemUserSecretUrl('metaSystemUserToken-work')
assert(secretUrl.includes('name=metaSystemUserToken-work'), 'secret name')
assert(secretUrl.includes('allowedHosts='), 'secret hosts')

const stripped = stripSecrets({ id: '1', access_token: 'SECRET', child: { page_access_token: 'SECRET' } })
assert(stripped.id === '1', 'kept id')
assert(!('access_token' in stripped), 'stripped token')
assert(!('page_access_token' in (stripped.child as object)), 'stripped nested token')
assert(boundedLimit(undefined) === 10, 'default limit')

console.log('pure-check ok')
`,
)

const result = spawnSync(process.execPath, ['--experimental-strip-types', '--no-warnings', src], {
	cwd: root,
	encoding: 'utf8',
})
unlinkSync(src)
process.stdout.write(result.stdout)
process.stderr.write(result.stderr)
process.exit(result.status ?? 1)