#!/usr/bin/env bash
# hub-core production stabilization gate for CORE-WP-0010-T05.
set -euo pipefail

BASE_URL="${CORE_HUB_BASE_URL:-https://hub.coulomb.social}"
STATE_HUB_URL="${STATE_HUB_URL:-http://127.0.0.1:8000}"
OPS_HUB_ROOT="${OPS_HUB_ROOT:-/home/worsch/ops-hub}"
RAPP_CORE_HUB_ROOT="${RAPP_CORE_HUB_ROOT:-/home/worsch/rapp-core-hub}"
EXPECTED_RUNTIME_VERSION="${EXPECTED_RUNTIME_VERSION:-0.2.0}"
export EXPECTED_RUNTIME_VERSION

echo "=== hub-core public authority (${BASE_URL}) ==="
curl -fsS "${BASE_URL}/healthz" | python3 -c '
import json, os, sys
payload = json.load(sys.stdin)
assert payload.get("status") == "ok", payload
assert payload.get("version") == os.environ["EXPECTED_RUNTIME_VERSION"], payload
'
echo "/healthz -> ok (version ${EXPECTED_RUNTIME_VERSION})"

curl -fsS "${BASE_URL}/readyz" | python3 -c '
import json, sys
payload = json.load(sys.stdin)
checks = payload.get("checks") or {}
assert payload.get("service") == "hub-core", payload
assert payload.get("status") == "ok", payload
assert checks.get("environment") == "production", checks
assert checks.get("configured_backend") == "postgresql", checks
assert checks.get("active_backend") == "postgresql", checks
assert checks.get("database") == "ok", checks
assert checks.get("authorization") == "ok", checks
assert checks.get("legacy_write_groups") == "none", checks
assert set(filter(None, checks.get("v2_write_groups", "").split(","))) == {
    "credentials", "deferred", "interaction", "registry"
}, checks
assert {"credentials", "deferred", "interaction", "operator", "registry", "system"} <= set(
    filter(None, checks.get("v2_groups", "").split(","))
), checks
'
echo "/readyz -> ok (PostgreSQL/auth healthy; hub-core is sole writer)"

hubs_code=$(curl -sS -o /dev/null -w '%{http_code}' "${BASE_URL}/api/v2/hubs")
echo "/api/v2/hubs -> ${hubs_code} (expect 401 hardened contract)"
test "${hubs_code}" = "401"

widget_count=$(curl -fsS "${BASE_URL}/api/v2/widget-types" | python3 -c '
import json, sys
payload = json.load(sys.stdin)
items = payload if isinstance(payload, list) else payload.get("data", [])
assert len(items) >= 26, len(items)
print(len(items))
')
echo "widget_types count=${widget_count} (expect >= 26)"

echo
echo "=== optional protected deployed smoke (needs approved token) ==="
if [[ -n "${CORE_HUB_OPERATOR_TOKEN_FILE:-}" && -f "${CORE_HUB_OPERATOR_TOKEN_FILE}" ]]; then
  make deployed-smoke
else
  echo "skip: set CORE_HUB_OPERATOR_TOKEN_FILE for full bootstrap smoke"
fi

echo
echo "=== required ops-hub consumer gate ==="
test -d "${OPS_HUB_ROOT}"
(cd "${OPS_HUB_ROOT}" && make interhub-gate IHUB_BASE="${BASE_URL}")

echo
echo "=== required deployment-package gate ==="
test -d "${RAPP_CORE_HUB_ROOT}"
(cd "${RAPP_CORE_HUB_ROOT}" && make verify-live)

echo
echo "=== last 6 core_hub_stabilization_check events ==="
curl -fsS "${STATE_HUB_URL}/progress/?event_type=core_hub_stabilization_check&limit=6" | python3 -c "
import json,sys
for e in json.load(sys.stdin):
    d=e.get('detail') or {}
    probe=d.get('probe') or {}
    print(e['created_at'][:19], (e.get('summary') or '')[:72],
          'pass='+str(probe.get('overall_pass')))
" 2>/dev/null || echo "no stabilization events yet"

echo
echo "ok: hub-core stabilization gate passed"