import assert from 'node:assert/strict'

const baseUrl = (process.env.BASE_URL || 'http://localhost:3000').replace(/\/$/, '')

async function get(path) {
  const response = await fetch(`${baseUrl}${path}`, { redirect: 'manual' })
  assert.equal(response.status, 200, `${path} returned ${response.status}`)
  return response
}

const health = await get('/api/health')
const healthBody = await health.json()
assert.equal(healthBody.status, 'ok')
assert.equal(healthBody.checks.database, 'ok')
assert.equal(healthBody.checks.uploads, 'writable')

const homepage = await get('/')
assert.equal(homepage.headers.get('x-content-type-options'), 'nosniff')
assert.equal(homepage.headers.get('x-frame-options'), 'DENY')
assert.match(homepage.headers.get('content-security-policy') || '', /frame-ancestors 'none'/)
const homepageHtml = await homepage.text()
assert.match(homepageHtml, /application\/ld\+json/)

const sitemap = await get('/sitemap.xml')
const sitemapXml = await sitemap.text()
const urls = [...sitemapXml.matchAll(/<loc>(.*?)<\/loc>/g)].map(match => new URL(match[1]).pathname)
assert.ok(urls.length >= 5, 'sitemap should contain public routes')
for (const path of urls) await get(path)

const robots = await get('/robots.txt')
assert.match(await robots.text(), /Disallow: \/admin/)

const hero = await get('/images/hero-bg-v3.webp')
assert.match(hero.headers.get('cache-control') || '', /immutable/)

console.log(`Smoke test passed: ${urls.length} sitemap routes, health, headers, robots and static cache.`)