"""Check the public authentication boundary; auth-cli verify checks private content."""
import json
import sys
import urllib.error
import urllib.parse
import urllib.request


class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None


def verify(base: str) -> None:
    opener = urllib.request.build_opener(NoRedirect())
    base = base.rstrip("/")

    def get(path):
        try:
            response = opener.open(base + path, timeout=15)
        except urllib.error.HTTPError as error:
            response = error
        with response:
            return response.code, response.headers, response.read()

    status, _, health = get("/api/health")
    assert status == 200 and json.loads(health) == {"status": "ok"}
    status, _, login = get("/login")
    assert status == 200 and "输入动态码" in login.decode()
    for path in ("/", "/docs/00-endor-concepts-draft", "/figures/endor-architecture.svg", "/figures/endor-review-gate.webp", "/figures/endor-review-desk.webp", "/docs/pretext/01-chapter", "/materials/pretext/verify.cjs", "/materials/pretext/results.chrome156.json"):
        status, headers, _ = get(path)
        assert status == 307, path
        target = urllib.parse.urlparse(urllib.parse.urljoin(base, headers["Location"]))
        assert target.netloc == urllib.parse.urlparse(base).netloc and target.path == "/login"
        assert "no-store" in headers.get("Cache-Control", "")
    assert get("/api/unknown")[0] == 401
    print(f"Public auth boundary passed: {base} (login, health, protected pages/SVG/API)", flush=True)


if __name__ == "__main__":
    verify(sys.argv[1])