#!/usr/bin/env node

import { readFile } from 'node:fs/promises'

export function validateDeploymentSource(policy, context) {
  const route = policy.routes?.find(candidate => candidate.distribution === context.distribution)
  if (!route || route.deployment_enabled !== true) {
    return { ok: false, reason: 'deployment_source_route_inactive' }
  }
  if (route.repository_id !== context.repositoryId || route.channel_id !== context.channelId) {
    return { ok: false, reason: 'deployment_source_binding_mismatch' }
  }
  if (route.source_owner_id !== context.sourceOwnerId) {
    return { ok: false, reason: 'deployment_source_owner_mismatch' }
  }
  if (!route.allowed_authorizers?.includes(context.authorizerId)) {
    return { ok: false, reason: 'deployment_authorizer_not_allowed' }
  }
  if (!route.allowed_personas?.includes(context.personaId)) {
    return { ok: false, reason: 'deployment_persona_not_allowed' }
  }
  if (!route.allowed_execution_runtimes?.includes(context.executionRuntimeId)) {
    return { ok: false, reason: 'deployment_execution_runtime_not_allowed' }
  }
  if (!route.allowed_targets?.includes(context.target)) {
    return { ok: false, reason: 'deployment_target_not_allowed' }
  }
  return { ok: true }
}

async function run() {
  const policyFile = process.env.HOLOLAKE_SOURCE_POLICY || 'research/source-route-policy.json'
  const policy = JSON.parse(await readFile(policyFile, 'utf8'))
  const context = {
    distribution: process.env.HOLOLAKE_DISTRIBUTION || '',
    repositoryId: process.env.HOLOLAKE_SOURCE_REPOSITORY_ID || '',
    channelId: process.env.HOLOLAKE_SOURCE_CHANNEL_ID || '',
    sourceOwnerId: process.env.HOLOLAKE_SOURCE_OWNER_ID || '',
    authorizerId: process.env.HOLOLAKE_HUMAN_AUTHORIZER_ID || '',
    personaId: process.env.HOLOLAKE_PERSONA_ID || '',
    executionRuntimeId: process.env.HOLOLAKE_EXECUTION_RUNTIME_ID || '',
    target: process.env.HOLOLAKE_DEPLOY_TARGET || '',
  }
  const result = validateDeploymentSource(policy, context)
  if (!result.ok) {
    console.error(`HoloLake deployment source rejected: ${result.reason}`)
    process.exitCode = 77
    return
  }
  console.log(`HoloLake deployment source verified: ${context.distribution} · ${context.channelId} · ${context.target}`)
}

if (import.meta.url === `file://${process.argv[1]}`) {
  await run()
}