import { mkdir, writeFile } from 'node:fs/promises'
import { createHash } from 'node:crypto'

const token = process.env.INTERNAL_SERVICE_TOKEN
if (!token) throw new Error('INTERNAL_SERVICE_TOKEN is required')
const printBase = process.env.PRINT_SERVICE_URL || 'http://127.0.0.1:9207'
const fileBase = process.env.FILE_SERVICE_URL || 'http://127.0.0.1:9206'
for (const url of [printBase, fileBase]) if (!['localhost', '127.0.0.1'].includes(new URL(url).hostname)) throw new Error('Local services only')
const customerId = process.env.OVERSEAS_TEST_CUSTOMER_ID
if (!customerId) throw new Error('OVERSEAS_TEST_CUSTOMER_ID is required')
const businessId = String(Date.now())
const headers = { 'X-Internal-Service-Token': token, 'X-Operator-Id': '1' }
const report = { scope: 'LOCAL_PRINT_AND_FILE_HTTP_ONLY', businessId, passed: false, files: [] }
const ensure = (ok, message) => { if (!ok) throw new Error(message) }
try {
  const rendered = await fetch(`${printBase}/internal/print/v1/pdfs/inbound-marks`, { method: 'POST', headers: { ...headers, 'Content-Type': 'application/json' }, body: JSON.stringify({ templateCode: 'INBOUND_MARK_V1', pageSpec: { widthMm: 100, heightMm: 100 }, downloadFileName: 'relabel-acceptance.pdf', labels: [{ topCode: 'RELABEL-ACCEPTANCE', warehouseText: 'ONT8', cartonText: 'CTNS:1-1', routeText: '验收测试标签', qrContent: `ACCEPTANCE-${businessId}` }] }) })
  const pdf = Buffer.from(await rendered.arrayBuffer())
  ensure(rendered.ok && pdf.subarray(0, 5).toString() === '%PDF-', `Print failed: HTTP ${rendered.status}`)
  report.pdfBytes = pdf.length
  const hash = value => createHash('sha256').update(value).digest('hex')
  for (const category of ['OVERSEAS_RELABEL_CARTON_TOTAL_DOCUMENT', 'OVERSEAS_RELABEL_SKU_TOTAL_DOCUMENT', 'OVERSEAS_RELABEL_ITEM_DOCUMENT']) {
    const form = new FormData(); form.append('file', new Blob([pdf], { type: 'application/pdf' }), 'relabel-acceptance.pdf')
    const path = `/internal/file/v1/business-files/${customerId}/${category}/${businessId}`
    const upload = await fetch(fileBase + path, { method: 'POST', headers, body: form })
    const body = await upload.json()
    ensure(upload.ok && String(body.code) === '200', `${category}: ${body.code} ${body.message}`)
    const fileId = body.data.fileId
    const downloaded = await fetch(`${fileBase}${path}/${fileId}/content`, { headers })
    const bytes = Buffer.from(await downloaded.arrayBuffer())
    ensure(downloaded.ok && hash(bytes) === hash(pdf), 'Downloaded PDF does not match uploaded bytes')
    const wrongOwner = await fetch(`${fileBase}/internal/file/v1/business-files/1/${category}/${businessId}/${fileId}`, { headers })
    const denied = await wrongOwner.json()
    ensure(!wrongOwner.ok || String(denied.code) !== '200', 'File was visible across customers')
    report.files.push({ category, fileId, sha256: hash(bytes), ownershipCheck: 'PASS' })
  }
  report.passed = true
} catch (error) { report.error = error.message; process.exitCode = 1 }
finally {
  await mkdir('reports/relabel-closure-20260916', { recursive: true })
  await writeFile('reports/relabel-closure-20260916/pdf.json', JSON.stringify(report, null, 2))
  console.log(JSON.stringify(report, null, 2))
}