import { execFileSync } from 'node:child_process';
import { readFileSync } from 'node:fs';
import { resolve } from 'node:path';

const root = resolve(import.meta.dirname, '../..');
const violations = [];

const productionFiles = execFileSync(
  'git',
  ['ls-files', 'src/apps/**/*.ts', 'src/apps/**/*.tsx', 'src/components/**/*.ts', 'src/components/**/*.tsx'],
  { cwd: root, encoding: 'utf8' },
)
  .split(/\r?\n/)
  .filter(Boolean);
for (const file of productionFiles) {
  const content = readFileSync(resolve(root, file), 'utf8');
  if (/from\s+['"]@\/mock(?:\/|['"])/.test(content)) violations.push(`${file}: production code imports @/mock`);
}

const clientControllers = execFileSync('git', ['ls-files', 'api/src/**/*.controller.ts'], {
  cwd: root,
  encoding: 'utf8',
})
  .split(/\r?\n/)
  .filter(Boolean);
for (const file of clientControllers) {
  const content = readFileSync(resolve(root, file), 'utf8');
  const clientClassOffset = content.indexOf('export class Client');
  const clientSection = clientClassOffset >= 0 ? content.slice(clientClassOffset) : content;
  if (/['"]client(?:\/|['"])/.test(clientSection) && /@TenantId\(\)/.test(clientSection)) {
    violations.push(`${file}: client route still reads request-controlled @TenantId()`);
  }
}

const clientApi = readFileSync(resolve(root, 'src/api/client/client.api.ts'), 'utf8');
if (/DEFAULT_CLIENT_TENANT_ID|getSessionTenantId|x-tenant-id/.test(clientApi)) {
  violations.push(
    'src/api/client/client.api.ts: client requests must derive tenant scope from the authenticated server session',
  );
}
const httpClient = readFileSync(resolve(root, 'src/api/core/httpClient.ts'), 'utf8');
if (
  /DEFAULT_CLIENT_TENANT_ID|getSessionTenantId/.test(httpClient) ||
  !httpClient.includes("options.tenantId && !path.startsWith('/client')")
) {
  violations.push('src/api/core/httpClient.ts: tenant headers must be reserved for explicit non-client operations');
}

const trackedBuildCaches = execFileSync('git', ['ls-files', '*.tsbuildinfo', '**/*.tsbuildinfo'], {
  cwd: root,
  encoding: 'utf8',
}).trim();
if (trackedBuildCaches)
  violations.push(`tracked TypeScript build caches: ${trackedBuildCaches.replace(/\r?\n/g, ', ')}`);

const usersService = readFileSync(resolve(root, 'api/src/users/users.service.ts'), 'utf8');
if (/createHash\(['"]sha256['"]\)/.test(usersService)) {
  violations.push('api/src/users/users.service.ts: password writes must use the versioned password hasher');
}
const authService = readFileSync(resolve(root, 'api/src/auth/auth.service.ts'), 'utf8');
if (/passwordHash\s*===|===\s*[^\n;]*passwordHash/.test(authService)) {
  violations.push('api/src/auth/auth.service.ts: password hashes must not be compared directly');
}
const ensureAdmin = readFileSync(resolve(root, 'tools/deploy/ensure-production-admin.mjs'), 'utf8');
if (
  /createHash\(['"]sha256['"]\)|function\s+hashPassword\s*\(/.test(ensureAdmin) ||
  !ensureAdmin.includes('api/dist/auth/password-hasher.js')
) {
  violations.push(
    'tools/deploy/ensure-production-admin.mjs: administrative password writes must use the API password hasher',
  );
}
for (const relativePath of ['tools/deploy/ensure-production-admin.mjs', 'tools/smoke/real-env-smoke.mjs']) {
  const content = readFileSync(resolve(root, relativePath), 'utf8');
  if (
    /function\s+hashPassword\s*\(|passwordHash:\s*(?:createHash|legacyHashPassword)/.test(content) ||
    !content.includes('api/dist/auth/password-hasher.js')
  ) {
    violations.push(`${relativePath}: user password writes must use the compiled API password hasher`);
  }
}

const packageJson = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
if (packageJson.dependencies?.['react-router-dom'] !== '7.18.2') {
  violations.push('package.json: react-router-dom must remain on the remediated 7.18.2 baseline');
}
if (packageJson.overrides?.nanoid !== '3.3.18') {
  violations.push('package.json: nanoid override must remain on the remediated 3.3.18 baseline');
}
const trackedAlternativeLocks = execFileSync('git', ['ls-files', 'pnpm-lock.yaml', 'yarn.lock'], {
  cwd: root,
  encoding: 'utf8',
}).trim();
if (trackedAlternativeLocks) {
  violations.push(
    `${trackedAlternativeLocks.replace(/\r?\n/g, ', ')}: npm/package-lock.json is the only supported committed dependency lock`,
  );
}
if (packageJson.packageManager !== 'npm@10.9.4') {
  violations.push('package.json: packageManager must pin the supported npm baseline');
}

if (violations.length) {
  console.error(violations.map((item) => `ERROR: ${item}`).join('\n'));
  process.exit(1);
}
console.log('Code quality structural checks passed.');