#!/usr/bin/env bash
set -euo pipefail

root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
docs=(
  "$root/docs/architecture/authentication.md"
  "$root/docs/install/authentication-local.md"
  "$root/docs/install/authentication-oidc.md"
  "$root/docs/install/authentik.md"
  "$root/docs/testing/authentication-manual-acceptance.md"
  "$root/docs/architecture/overview.md"
  "$root/docs/install/local.md"
  "$root/docs/install/server.md"
  "$root/docs/install/psd-workspace-setup.md"
  "$root/docs/install/reverse-proxy-caddy.md"
  "$root/docs/install/reverse-proxy-nginx.md"
  "$root/docs/guida-utente.md"
  "$root/docs/index.md"
  "$root/README.md"
  "$root/PROJECT_STATE.md"
)

for path in "${docs[@]}"; do
  [[ -f "$path" ]] || { echo "auth docs smoke: missing $path" >&2; exit 1; }
done

corpus=$(mktemp)
trap 'rm -f "$corpus"' EXIT
cat "${docs[@]}" >"$corpus"

required=(
  "tht auth"
  "groups"
  "TOT Admin"
  "THT_OIDC_CLIENT_SECRET"
  "THT_AUTHENTIK_API_TOKEN"
  "Remember me"
  "oidc_mapped_group_missing"
)
for term in "${required[@]}"; do
  rg -Fq "$term" "$corpus" || { echo "auth docs smoke: missing required term: $term" >&2; exit 1; }
done

if rg -n -i 'thothii-admin|thothctl[[:space:]]+auth' "$corpus"; then
  echo "auth docs smoke: forbidden authentication CLI wording" >&2
  exit 1
fi
if rg -n -i 'password[[:space:]]*[:=][[:space:]]*(?!<|YOUR|REPLACE|CHANGE|FILE|PROMPT)' --pcre2 "$corpus"; then
  echo "auth docs smoke: plaintext password example" >&2
  exit 1
fi
if rg -n -i 'unmapped[^.]{0,100}(generate|produce|emit|cause)[^.]{0,100}(warning|warn)|unmapped[^.]{0,100}warning(s)?[[:space:]]+(are|is)[[:space:]]+emitted' "$corpus"; then
  echo "auth docs smoke: misleading warning claim for unmapped groups" >&2
  exit 1
fi

echo "auth docs smoke: required terms and forbidden wording checks passed"