#!/usr/bin/env node

import { execFileSync } from "node:child_process";
import fs from "node:fs";
import path from "node:path";

const allowed = new Map([
  [
    "guanghu-ice-heart",
    "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
  ],
  [
    "hololake-system-architecture",
    "https://guanghulab.com/code/bingshuo/hololake-system-architecture.git",
  ],
]);

function classify(repositoryPath) {
  const resolved = path.resolve(repositoryPath);
  const gitMarker = path.join(resolved, ".git");
  if (!fs.existsSync(gitMarker)) {
    return { path: resolved, state: "NOT_GIT_WORKTREE" };
  }
  let remote;
  try {
    remote = execFileSync(
      "git",
      ["remote", "get-url", "--push", "origin"],
      { cwd: resolved, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
    ).trim();
  } catch {
    return { path: resolved, state: "ORIGIN_PUSH_URL_MISSING" };
  }
  let parsed;
  try {
    parsed = new URL(remote);
  } catch {
    return { path: resolved, state: "NON_CANONICAL_REMOTE_FORMAT" };
  }
  if (parsed.username || parsed.password) {
    return { path: resolved, state: "CREDENTIAL_BEARING_REMOTE_FORBIDDEN" };
  }
  const slug = path.basename(parsed.pathname, ".git");
  const expected = allowed.get(slug);
  if (!expected || remote !== expected) {
    return {
      path: resolved,
      state: remote.includes("/fifth-domain/")
        ? "HISTORICAL_REMOTE_NO_PUSH"
        : "NON_CANONICAL_REMOTE_NO_PUSH",
    };
  }
  return {
    path: resolved,
    repository: slug,
    state: "CANONICAL_PUSH_ROUTE",
    remote: expected,
  };
}

const targets = process.argv.slice(2);
if (!targets.length) {
  process.stderr.write(
    "usage: node scripts/audit-code-channel-route.mjs <git-worktree> [...]\n",
  );
  process.exit(2);
}

const results = targets.map(classify);
process.stdout.write(`${JSON.stringify(results, null, 2)}\n`);
if (results.some((entry) => entry.state !== "CANONICAL_PUSH_ROUTE")) {
  process.exitCode = 1;
}