#!/usr/bin/env bash
set -Eeuo pipefail

ROOT="${ROOT:-/var/www/dhv2.korexlabs.com}"
API_URL="${API_URL:-http://127.0.0.1:3101/api/v3}"
TMP_MIGRATION="/tmp/dhv2-d5322-accept-migration-$$.log"
trap 'rm -f "$TMP_MIGRATION"' EXIT
cd "$ROOT"

echo "========== D5.3.22 · VERSIONES =========="
[[ "$(node -p "require('./api-v3/package.json').version")" == "0.19.3-22" ]]
[[ "$(node -p "require('./web-v2/package.json').version")" == "0.19.3-22" ]]
grep -Fq "API_PHASE = 'D5.3.22'" api-v3/src/version.ts
grep -Fq "APP_PHASE = 'Fase D5.3.22 · Revisión directiva de Informes'" web-v2/src/config/version.ts
echo "API: 0.19.3-22"
echo "WEB: 0.19.3-22"

echo
echo "========== D5.3.22 · DB Y MIGRACIONES =========="
[[ "$(docker inspect dhv2-db --format '{{.State.Health.Status}}')" == "healthy" ]]
docker compose exec -T db sh -lc 'pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB"'
docker compose --profile tools run --rm migrate npm run migration:show 2>&1 | tee "$TMP_MIGRATION"
grep -Fq 'Pending migrations: no' "$TMP_MIGRATION"
for table in inspection_report_revisions inspection_report_signatures; do
  docker compose exec -T db sh -lc "psql -U \"\$POSTGRES_USER\" -d \"\$POSTGRES_DB\" -Atc \"SELECT to_regclass('public.$table');\"" | grep -Fxq "$table"
done
for column in review_status current_revision_number approved_revision_id approved_by approved_at review_note signed_at; do
  docker compose exec -T db sh -lc "psql -U \"\$POSTGRES_USER\" -d \"\$POSTGRES_DB\" -Atc \"SELECT column_name FROM information_schema.columns WHERE table_name='inspection_reports' AND column_name='$column';\"" | grep -Fxq "$column"
done
echo "Revisiones versionadas, aprobación y firma final presentes: OK"

echo
echo "========== D5.3.22 · PERMISOS DIRECTOR =========="
for permission in inspection_reports.revise inspection_reports.review inspection_reports.sign_final; do
  docker compose exec -T db sh -lc "psql -U \"\$POSTGRES_USER\" -d \"\$POSTGRES_DB\" -Atc \"SELECT code FROM permissions WHERE code='$permission';\"" | grep -Fxq "$permission"
  SEEDED_ROLES="$(docker compose exec -T db sh -lc "psql -U \"\$POSTGRES_USER\" -d \"\$POSTGRES_DB\" -Atc \"SELECT COALESCE(string_agg(r.code,',' ORDER BY r.code),'') FROM roles r JOIN role_permissions rp ON rp.role_id=r.id JOIN permissions p ON p.id=rp.permission_id WHERE p.code='$permission' AND r.code IN ('admin','director','supervisor','inspector','auditor');\"")"
  [[ "$SEEDED_ROLES" == "director" ]]
done
grep -Fq "role.code = 'director'" api-v3/src/inspection-reports/inspection-report-review.service.ts
echo "Revisión, aprobación y firma final reservadas al Director: OK"

echo
echo "========== D5.3.22 · HEALTH =========="
HEALTH="$(curl -fsS "$API_URL/health")"
echo "$HEALTH"
grep -Fq '"version":"0.19.3-22"' <<<"$HEALTH"
grep -Fq '"phase":"D5.3.22"' <<<"$HEALTH"
grep -Fq '"database":"ok"' <<<"$HEALTH"

echo
echo "========== D5.3.22 · VERSIONADO WORD =========="
grep -Fq "'AUTO'" api-v3/src/inspection-reports/inspection-report-word.service.ts
grep -Fq "'DIRECTOR_UPLOAD'" api-v3/src/inspection-reports/inspection-report-review.service.ts
grep -Fq 'validateInspectionReportRevisionContainer' api-v3/src/inspection-reports/inspection-report-review.service.ts
grep -Fq 'vbaProject' api-v3/src/inspection-reports/inspection-report-revision-file.ts
echo "Word automático como versión 1 y correcciones append-only con integridad: OK"

echo
echo "========== D5.3.22 · APROBACIÓN Y FIRMA =========="
grep -Fq "review_status = 'APPROVED'" api-v3/src/inspection-reports/inspection-report-review.service.ts
grep -Fq "review_status = 'SIGNED'" api-v3/src/inspection-reports/inspection-report-review.service.ts
grep -Fq 'DH-INSPECTION-REPORT-SIGNATURE-V1' api-v3/src/inspection-reports/inspection-report-review.service.ts
grep -Fq 'sha256CanonicalJson(payload)' api-v3/src/inspection-reports/inspection-report-review.service.ts
echo "Firma electrónica vinculada a Informe congelado y revisión aprobada: OK"

echo
echo "========== D5.3.22 · FLUJO WEB =========="
grep -Fq 'Agregar Word corregido' web-v2/src/pages/ReportDetailPage.tsx
grep -Fq 'Aprobar versión actual' web-v2/src/pages/ReportDetailPage.tsx
grep -Fq 'Firmar informe final' web-v2/src/pages/ReportDetailPage.tsx
grep -Fq 'inspection_reports.sign_final' web-v2/src/pages/ReportDetailPage.tsx
echo "Director puede versionar, aprobar y firmar desde el expediente del Informe: OK"

echo
echo "========== D5.3.22 · REGLAS PRESERVADAS =========="
grep -Fq 'assertVisitHasNoAct' api-v3/src/inspection-acts/inspection-acts.service.ts
grep -Fq 'INSPECTION_VISIT_ACT_ALREADY_EXISTS' api-v3/src/inspection-acts/inspection-acts.service.ts
grep -Fq 'INSPECTION_FINDING_RESPONSE_IMMUTABLE' api-v3/src/inspection-findings/inspection-findings.service.ts
if grep -Fq 'ALTER TABLE inspection_acts' api-v3/src/database/migrations/1788631200000-phase-d5-3-22-director-report-review.ts; then exit 1; fi
if grep -Fq 'ALTER TABLE inspection_findings' api-v3/src/database/migrations/1788631200000-phase-d5-3-22-director-report-review.ts; then exit 1; fi
echo "Una visita = una Acta; Acta y Hallazgos originales siguen inmutables: OK"

echo
echo "========== D5.3.22 · SMTP =========="
SMTP_STATE="$(docker compose exec -T api sh -lc 'if [ -n "$SMTP_HOST" ] && [ -n "$MAIL_FROM" ]; then echo configured; else echo pending; fi')"
if [[ "$SMTP_STATE" == "configured" ]]; then
  echo "SMTP configurado: la entrega documental puede operar"
else
  echo "SMTP sigue sin configurar: no bloquea revisión, aprobación ni firma"
fi

echo
echo "========== D5.3.22 · HIGIENE DE CÓDIGO =========="
if grep -RnhE --include='*.ts' --include='*.tsx' '^[[:space:]]*(//|/\*|\*)' api-v3/src web-v2/src; then
  echo "ERROR: quedaron comentarios narrativos en código de producción"
  exit 1
fi
if grep -nE '/\*|\*/' web-v2/src/styles.css; then
  echo "ERROR: quedaron comentarios internos en estilos de producción"
  exit 1
fi
echo "Código de producción preparado para revisión externa: OK"

echo
echo "========== D5.3.22 · SEGURIDAD HEREDADA =========="
STRONG_BACKUP="$(find /root/DH_V2_BACKUPS -maxdepth 1 -type d -name 'INVENTARIO_A_REVISAR_*' -printf '%T@ %p\n' | sort -nr | head -n1 | cut -d' ' -f2-)"
[[ -n "$STRONG_BACKUP" && -s "$STRONG_BACKUP/BACKUP_OK.txt" ]]
grep -Fq 'INVENTARIO A REVISAR' "$STRONG_BACKUP/BACKUP_OK.txt"
echo "Backup fuerte de referencia: $STRONG_BACKUP"

echo
echo "========== D5.3.22 · CONTENEDORES =========="
docker compose ps -a
[[ "$(docker inspect dhv2-db --format '{{.State.Health.Status}}')" == "healthy" ]]
[[ "$(docker inspect dhv2-api --format '{{.State.Status}}')" == "running" ]]
[[ "$(docker inspect dhv2-web --format '{{.State.Status}}')" == "running" ]]

echo
echo "ACEPTACIÓN DE FASE D5.3.22: OK"