#!/usr/bin/env pwsh
# Codegen freshness guard for CI (IPC-01, IPC-19, IPC-20, IPC-25, CLI-02).
#
# Four checks, all Linux/macOS-runnable (no Server build, no x86 worker):
#   1. Published client descriptor set matches the current .proto sources (delegates to
#      publish-client-proto-inputs.ps1 -Check, which normalizes source_code_info so it is
#      protoc-version tolerant).
#   2. The committed C# under Contracts/Generated matches a fresh regeneration. Grpc.Tools is
#      pinned in the contracts csproj, so a clean checkout regenerates byte-identical output; a
#      non-empty git diff means a .proto was edited without regenerating and committing Generated/
#      (which breaks the net48 worker build with CS0246 — see docs/Contracts.md).
#   3. The Rust crate's vendored protos (clients/rust/protos/*.proto — build inputs that make the
#      crate buildable outside the repo, CLI-02) are byte-identical to the canonical Contracts
#      protos, and the two directories hold the same set of files. A drift means a .proto was edited
#      without refreshing the vendored copies, which would publish a stale wire contract to crate
#      consumers while the in-repo build stays correct. The sweep runs both directions: a canonical
#      proto with no vendored copy is just as broken (the published crate cannot build standalone),
#      and it is invisible in-repo because build.rs prefers the canonical directory when it exists.
#   4. The committed Go and Python client bindings match a fresh regeneration (IPC-25). The two
#      per-client generate-proto.ps1 scripts pin their generators (protoc-gen-go v1.36.11 /
#      protoc-gen-go-grpc v1.6.2 for Go; grpcio-tools 1.80.0 for Python), so a clean checkout
#      regenerates deterministic output; a non-empty git diff means a .proto was edited without
#      regenerating and committing those bindings. A missing generator FAILS the check (a skipped
#      guard is the exact silent-drift hole IPC-25 closes), never skips it.
#
# The x86 Worker + Worker.Tests are Windows-only and are guarded by the SSH-driven `windows-x86`
# CI job (see docs/GatewayTesting.md, Continuous Integration), not here.

[CmdletBinding()]
param()

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

$repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..')
$generatedDir = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/Generated'
$contractsProject = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csproj'
$failures = New-Object System.Collections.Generic.List[string]

Write-Host '== Check 1/4: client descriptor set freshness =='
try {
    & (Join-Path $PSScriptRoot 'publish-client-proto-inputs.ps1') -Check
    if ($LASTEXITCODE -ne 0) {
        $failures.Add('Client descriptor set is stale (publish-client-proto-inputs.ps1 -Check failed).')
    }
}
catch {
    $failures.Add("Descriptor freshness check failed: $($_.Exception.Message)")
}

Write-Host ''
Write-Host '== Check 2/4: Contracts/Generated matches a fresh regeneration =='
try {
    # Force a full regeneration: Grpc.Tools skips regen when the committed .cs look up to date, so
    # remove them first (the documented "del Generated/*.cs to force regen" trick).
    if (Test-Path $generatedDir) {
        Get-ChildItem -Path $generatedDir -Filter '*.cs' -Recurse -File | Remove-Item -Force
    }

    & dotnet build $contractsProject -c Release --nologo | Out-Host
    if ($LASTEXITCODE -ne 0) {
        $failures.Add('Contracts project failed to build during codegen check.')
    }

    # Pipe through Out-String so a clean tree (git emits nothing -> $null) does not throw
    # "cannot call a method on a null-valued expression"; Out-String yields '' for no output.
    $diff = (& git -C $repoRoot status --porcelain -- 'src/ZB.MOM.WW.MxGateway.Contracts/Generated' | Out-String).Trim()
    if (-not [string]::IsNullOrEmpty($diff)) {
        Write-Host $diff
        $failures.Add('Contracts/Generated differs from a fresh regeneration. Run `dotnet build` on the contracts project and commit Generated/ (required for the net48 worker build).')
    }
}
catch {
    $failures.Add("Generated codegen check failed: $($_.Exception.Message)")
}

Write-Host ''
Write-Host '== Check 3/4: Rust vendored protos match canonical Contracts protos =='
try {
    $canonicalProtoDir = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/Protos'
    $vendoredProtoDir = Join-Path $repoRoot 'clients/rust/protos'
    foreach ($vendored in Get-ChildItem -Path $vendoredProtoDir -Filter '*.proto' -File) {
        $canonical = Join-Path $canonicalProtoDir $vendored.Name
        if (-not (Test-Path $canonical)) {
            $failures.Add("Vendored Rust proto has no canonical counterpart: $($vendored.Name).")
            continue
        }
        $vendoredHash = (Get-FileHash -Algorithm SHA256 $vendored.FullName).Hash
        $canonicalHash = (Get-FileHash -Algorithm SHA256 $canonical).Hash
        if ($vendoredHash -ne $canonicalHash) {
            $failures.Add("Rust vendored proto drifted from canonical: clients/rust/protos/$($vendored.Name). Refresh it from src/ZB.MOM.WW.MxGateway.Contracts/Protos/$($vendored.Name).")
        }
    }

    # Reverse direction: a canonical proto that was never vendored passes the loop above (it only
    # walks the vendored dir) but breaks a standalone crate build, because build.rs falls back to
    # clients/rust/protos/ only outside the repo — in-repo it reads the canonical dir and stays green.
    foreach ($canonicalProto in Get-ChildItem -Path $canonicalProtoDir -Filter '*.proto' -File) {
        $vendoredCounterpart = Join-Path $vendoredProtoDir $canonicalProto.Name
        if (-not (Test-Path $vendoredCounterpart)) {
            $failures.Add("Canonical proto is not vendored for the Rust crate: $($canonicalProto.Name). Copy src/ZB.MOM.WW.MxGateway.Contracts/Protos/$($canonicalProto.Name) to clients/rust/protos/$($canonicalProto.Name) (and add it to build.rs's input list).")
        }
    }
}
catch {
    $failures.Add("Rust vendored proto check failed: $($_.Exception.Message)")
}

Write-Host ''
Write-Host '== Check 4/4: Go and Python client bindings match a fresh regeneration =='
try {
    # Regenerate both binding sets with their pinned generators, then diff. The per-client scripts
    # throw on a missing or off-pin generator, so any failure here FAILS the check rather than
    # skipping it (a skipped guard is exactly the silent-drift hole IPC-25 closes).
    $goBindingDir = 'clients/go/internal/generated'
    $pyBindingDir = 'clients/python/src/zb_mom_ww_mxgateway/generated'

    & (Join-Path $repoRoot 'clients/go/generate-proto.ps1') | Out-Host
    & (Join-Path $repoRoot 'clients/python/generate-proto.ps1') | Out-Host

    $bindingDiff = (& git -C $repoRoot status --porcelain -- $goBindingDir $pyBindingDir | Out-String).Trim()
    if (-not [string]::IsNullOrEmpty($bindingDiff)) {
        Write-Host $bindingDiff
        $failures.Add("Go/Python client bindings differ from a fresh regeneration. Run clients/go/generate-proto.ps1 and clients/python/generate-proto.ps1 with the pinned generators and commit $goBindingDir and $pyBindingDir.")
    }
}
catch {
    $failures.Add("Go/Python codegen check failed (tool missing or regeneration error): $($_.Exception.Message)")
}

Write-Host ''
if ($failures.Count -gt 0) {
    Write-Host 'Codegen freshness check FAILED:' -ForegroundColor Red
    foreach ($failure in $failures) {
        Write-Host "  - $failure" -ForegroundColor Red
    }
    exit 1
}

Write-Host 'Codegen freshness check passed.' -ForegroundColor Green
