#!/usr/bin/env bash
set -euo pipefail

DOCS_BASE_URL="${1:-https://docs.codlab.app}"
DOCS_PROBE_REGION="${CODECR_PROBE_REGION:-unlabeled}"
DOCS_VERIFY_DIR="$(mktemp -d)"
trap 'rm -rf -- "$DOCS_VERIFY_DIR"' EXIT

declare -A EXPECTED_SHA256=(
  [styles.css]="742f80b1d23664723603dba0878427ef9b2e0052907391b131e772b1d30dd456"
  [app.js]="a48319387beaba22fbcec5452ecec2de46b5a35ccac95b1f36e29504b4aacc41"
)

for ASSET in styles.css app.js; do
  ASSET_URL="${DOCS_BASE_URL%/}/$ASSET?v=20261006-globe"

  curl --fail --silent --show-error --location \
    --header 'Accept-Encoding: identity' \
    --dump-header "$DOCS_VERIFY_DIR/$ASSET.prime.headers" \
    --output /dev/null "$ASSET_URL"

  curl --fail --silent --show-error --location \
    --header 'Accept-Encoding: identity' \
    --dump-header "$DOCS_VERIFY_DIR/$ASSET.edge.headers" \
    --output "$DOCS_VERIFY_DIR/$ASSET" "$ASSET_URL"

  ACTUAL_SHA256="$(sha256sum "$DOCS_VERIFY_DIR/$ASSET" | awk '{print $1}')"
  if [[ "$ACTUAL_SHA256" != "${EXPECTED_SHA256[$ASSET]}" ]]; then
    echo "FAIL region=$DOCS_PROBE_REGION asset=$ASSET sha256=$ACTUAL_SHA256" >&2
    exit 1
  fi

  CACHE_STATUS="$(awk -F': *' 'tolower($1)=="cf-cache-status" {gsub(/\r/,"",$2); print toupper($2)}' \
    "$DOCS_VERIFY_DIR/$ASSET.edge.headers" | tail -n 1)"
  CF_RAY="$(awk -F': *' 'tolower($1)=="cf-ray" {gsub(/\r/,"",$2); print $2}' \
    "$DOCS_VERIFY_DIR/$ASSET.edge.headers" | tail -n 1)"

  # Integrity is mandatory; edge warmth depends on the hosting layer.

  echo "PASS region=$DOCS_PROBE_REGION asset=$ASSET cache=${CACHE_STATUS:-UNKNOWN} cf_ray=$CF_RAY sha256=$ACTUAL_SHA256"
done