#!/bin/bash
# verify-user-auth.sh
# 验证 rmdc-user-auth 模块的设计一致性和代码规范
# 依赖: bash, grep, sed, find

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SKILL_DIR="$(dirname "$SCRIPT_DIR")"
REFERENCE_DIR="$SKILL_DIR/reference"

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# 计数器
PASS_COUNT=0
FAIL_COUNT=0
WARN_COUNT=0

# 结果输出
pass() {
    echo -e "${GREEN}[PASS]${NC} $1"
    ((PASS_COUNT++))
}

fail() {
    echo -e "${RED}[FAIL]${NC} $1"
    ((FAIL_COUNT++))
}

warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
    ((WARN_COUNT++))
}

echo "================================================"
echo "rmdc-user-auth Skill 验证脚本"
echo "================================================"
echo ""

# =====================================================
# 1. Reference 目录章节分层检查
# =====================================================
echo "--- 1. Reference 目录章节分层检查 ---"

# 检查是否存在章节目录 (01-* 开头)
if find "$REFERENCE_DIR" -maxdepth 1 -type d -name '0*-*' | grep -q .; then
    CHAPTER_COUNT=$(find "$REFERENCE_DIR" -maxdepth 1 -type d -name '0*-*' | wc -l)
    pass "Reference 目录包含 $CHAPTER_COUNT 个章节分层目录"
else
    fail "Reference 目录缺少章节分层目录 (需 01-*, 02-* 等)"
fi

# 检查至少 2 个 reference 文件位于章节子目录
NON_ROOT_FILES=$(find "$REFERENCE_DIR" -mindepth 2 -type f -name "*.md" | wc -l)
if [ "$NON_ROOT_FILES" -ge 2 ]; then
    pass "章节子目录中包含 $NON_ROOT_FILES 个 reference 文件"
else
    fail "章节子目录中 reference 文件不足 2 个 (当前: $NON_ROOT_FILES)"
fi

# 检查 DDS-Section 字段
DDS_SECTION_COUNT=$(grep -r "DDS-Section:" "$REFERENCE_DIR" 2>/dev/null | wc -l)
if [ "$DDS_SECTION_COUNT" -ge 3 ]; then
    pass "Reference 文件包含 $DDS_SECTION_COUNT 处 DDS-Section 标注"
else
    fail "Reference 文件 DDS-Section 标注不足 3 处 (当前: $DDS_SECTION_COUNT)"
fi

# 检查 DDS-Lines 字段
DDS_LINES_COUNT=$(grep -r "DDS-Lines:" "$REFERENCE_DIR" 2>/dev/null | wc -l)
if [ "$DDS_LINES_COUNT" -ge 3 ]; then
    pass "Reference 文件包含 $DDS_LINES_COUNT 处 DDS-Lines 标注"
else
    fail "Reference 文件 DDS-Lines 标注不足 3 处 (当前: $DDS_LINES_COUNT)"
fi

echo ""

# =====================================================
# 2. 核心设计要素覆盖检查
# =====================================================
echo "--- 2. 核心设计要素覆盖检查 ---"

# API 端点
if [ -f "$REFERENCE_DIR/10-api-design/api-endpoints.md" ]; then
    pass "API 端点设计文档存在"
else
    fail "API 端点设计文档缺失 (reference/10-api-design/api-endpoints.md)"
fi

# 权限表 Schema
if [ -f "$REFERENCE_DIR/09-data-model/permission-tables-schema.md" ]; then
    pass "权限表 Schema 文档存在"
else
    fail "权限表 Schema 文档缺失 (reference/09-data-model/permission-tables-schema.md)"
fi

# 用户表 Schema
if [ -f "$REFERENCE_DIR/09-data-model/user-table-schema.md" ]; then
    pass "用户表 Schema 文档存在"
else
    fail "用户表 Schema 文档缺失 (reference/09-data-model/user-table-schema.md)"
fi

# 状态机/工单流程
if [ -f "$REFERENCE_DIR/06-registration-workflow/registration-workflow.md" ]; then
    pass "注册工单流程文档存在"
else
    fail "注册工单流程文档缺失 (reference/06-registration-workflow/registration-workflow.md)"
fi

# 权限模型
if [ -f "$REFERENCE_DIR/08-permission-model/permission-architecture.md" ]; then
    pass "权限架构设计文档存在"
else
    fail "权限架构设计文档缺失 (reference/08-permission-model/permission-architecture.md)"
fi

# 安全模型
if [ -f "$REFERENCE_DIR/11-security/security-compliance.md" ]; then
    pass "安全合规文档存在"
else
    fail "安全合规文档缺失 (reference/11-security/security-compliance.md)"
fi

echo ""

# =====================================================
# 3. 关键设计内容检查
# =====================================================
echo "--- 3. 关键设计内容检查 ---"

# 检查 JWT Claims 定义
if grep -q "user_id.*username.*role.*status" "$REFERENCE_DIR/03-authentication/jwt-claims.md" 2>/dev/null; then
    pass "JWT Claims 包含必要字段 (user_id/username/role/status)"
else
    fail "JWT Claims 缺少必要字段定义"
fi

# 检查 RBAC 角色层级
if grep -q "superadmin.*admin.*normal.*third" "$REFERENCE_DIR/05-rbac/rbac-roles.md" 2>/dev/null; then
    pass "RBAC 角色层级定义完整"
else
    fail "RBAC 角色层级定义不完整"
fi

# 检查 account_expires_at 字段
if grep -q "account_expires_at\|AccountExpiresAt" "$REFERENCE_DIR/09-data-model/user-table-schema.md" 2>/dev/null; then
    pass "用户表包含 account_expires_at 字段"
else
    fail "用户表缺少 account_expires_at 字段"
fi

# 检查 must_change_password 字段
if grep -q "must_change_password\|MustChangePassword" "$REFERENCE_DIR/09-data-model/user-table-schema.md" 2>/dev/null; then
    pass "用户表包含 must_change_password 字段"
else
    fail "用户表缺少 must_change_password 字段"
fi

# 检查 jenkins_acls 表定义
if grep -q "jenkins_acls" "$REFERENCE_DIR/08-permission-model/jenkins-acls.md" 2>/dev/null; then
    pass "Jenkins 权限表 (jenkins_acls) 已定义"
else
    fail "Jenkins 权限表定义缺失"
fi

# 检查 project_acls 表定义
if grep -q "project_acls" "$REFERENCE_DIR/08-permission-model/project-acls.md" 2>/dev/null; then
    pass "项目权限表 (project_acls) 已定义"
else
    fail "项目权限表定义缺失"
fi

# 检查工单接口约束
if grep -q "前端不允许直接调用创建工单接口\|工单由用户管理接口内部自动创建" "$REFERENCE_DIR/10-api-design/api-endpoints.md" 2>/dev/null; then
    pass "API 文档包含工单接口约束说明"
else
    warn "API 文档可能缺少工单接口约束说明"
fi

# 检查 PermissionModule 枚举
if grep -q "PermissionModule" "$REFERENCE_DIR/08-permission-model/permission-architecture.md" 2>/dev/null; then
    pass "权限模块枚举 (PermissionModule) 已定义"
else
    fail "权限模块枚举定义缺失"
fi

echo ""

# =====================================================
# 4. Examples 和 Scripts 检查
# =====================================================
echo "--- 4. Examples 和 Scripts 检查 ---"

# 检查示例代码
if [ -f "$SKILL_DIR/examples/auth-handler-skeleton.go" ]; then
    pass "认证处理器骨架代码存在"
else
    warn "认证处理器骨架代码缺失 (examples/auth-handler-skeleton.go)"
fi

if [ -f "$SKILL_DIR/examples/permission-check-skeleton.go" ]; then
    pass "权限检查骨架代码存在"
else
    warn "权限检查骨架代码缺失 (examples/permission-check-skeleton.go)"
fi

if [ -f "$SKILL_DIR/examples/workflow-callback-skeleton.go" ]; then
    pass "工单回调骨架代码存在"
else
    warn "工单回调骨架代码缺失 (examples/workflow-callback-skeleton.go)"
fi

echo ""

# =====================================================
# 5. SKILL.md 检查
# =====================================================
echo "--- 5. SKILL.md 检查 ---"

SKILL_MD="$SKILL_DIR/SKILL.md"

# 检查 frontmatter
if grep -q "^name: developing-user-auth" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md name 字段正确"
else
    fail "SKILL.md name 字段错误或缺失"
fi

if grep -q "^description:" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md description 字段存在"
else
    fail "SKILL.md description 字段缺失"
fi

if grep -q "^argument-hint:" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md argument-hint 字段存在"
else
    fail "SKILL.md argument-hint 字段缺失"
fi

# 检查 Plan/Verify/Execute/Pitfalls 结构
if grep -q "## Plan" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md 包含 Plan 章节"
else
    fail "SKILL.md 缺少 Plan 章节"
fi

if grep -q "## Verify" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md 包含 Verify 章节"
else
    fail "SKILL.md 缺少 Verify 章节"
fi

if grep -q "## Execute" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md 包含 Execute 章节"
else
    fail "SKILL.md 缺少 Execute 章节"
fi

if grep -q "## Pitfalls" "$SKILL_MD" 2>/dev/null; then
    pass "SKILL.md 包含 Pitfalls 章节"
else
    fail "SKILL.md 缺少 Pitfalls 章节"
fi

# 检查动态注入示例
DYNAMIC_INJECT_COUNT=$(grep -c '!`' "$SKILL_MD" 2>/dev/null || echo "0")
if [ "$DYNAMIC_INJECT_COUNT" -ge 2 ]; then
    pass "SKILL.md 包含 $DYNAMIC_INJECT_COUNT 处动态注入示例"
else
    fail "SKILL.md 动态注入示例不足 2 处 (当前: $DYNAMIC_INJECT_COUNT)"
fi

# 检查 Pitfalls 数量
PITFALL_COUNT=$(grep -c "^\d\." "$SKILL_MD" 2>/dev/null || grep -c "^[0-9]\." "$SKILL_MD" 2>/dev/null || echo "0")
if [ "$PITFALL_COUNT" -ge 3 ]; then
    pass "SKILL.md Pitfalls 包含 $PITFALL_COUNT 条"
else
    warn "SKILL.md Pitfalls 条目可能不足 (建议 3-8 条)"
fi

# 检查行数 (应 < 500)
LINE_COUNT=$(wc -l < "$SKILL_MD" 2>/dev/null || echo "0")
if [ "$LINE_COUNT" -lt 500 ]; then
    pass "SKILL.md 行数 ($LINE_COUNT) 符合规范 (<500)"
else
    warn "SKILL.md 行数 ($LINE_COUNT) 超过建议值 500"
fi

echo ""

# =====================================================
# 汇总
# =====================================================
echo "================================================"
echo "验证结果汇总"
echo "================================================"
echo -e "${GREEN}PASS${NC}: $PASS_COUNT"
echo -e "${RED}FAIL${NC}: $FAIL_COUNT"
echo -e "${YELLOW}WARN${NC}: $WARN_COUNT"
echo ""

if [ "$FAIL_COUNT" -eq 0 ]; then
    echo -e "${GREEN}✓ 所有必要检查通过${NC}"
    exit 0
else
    echo -e "${RED}✗ 存在 $FAIL_COUNT 项失败，请修复后重新验证${NC}"
    exit 1
fi
