#!/usr/bin/env bash
# DW store kit: verify_public.sh (DRAFT, read-only). Anyone can run it from anywhere.
# Usage: bash verify_public.sh example.com OUT_DIR
# Checks every built file over HTTPS on the domain and on www., compares md5 (after dropping the editor loader line
# the app adds to HTML), checks the public catalog API and that cart/checkout/account pages are noindex.
set -u
DOMAIN="$1"; OUT="$2"; fail=0
strip() { sed -E '/^<script>.*\/_dw\/edit\.js.*<\/script>$/d'; }
for host in "$DOMAIN" "www.$DOMAIN"; do
  for f in $(cd "$OUT" && find store assets -type f | sort); do
    want=$(strip < "$OUT/$f" | md5sum | cut -d' ' -f1)
    code=$(curl -s -o /tmp/vp.$$ -w '%{http_code}' --max-time 20 "https://$host/$f")
    got=$(strip < /tmp/vp.$$ | md5sum | cut -d' ' -f1)
    if [ "$code" != 200 ]; then echo "FAIL $host/$f http=$code"; fail=1
    elif [ "$got" != "$want" ]; then echo "DIFF $host/$f (cached copy? anonymous cache lasts ~5 min)"; fail=1; fi
  done
  for p in cart checkout account; do
    c=$(curl -s -o /tmp/vp.$$ -w '%{http_code}' --max-time 20 "https://$host/store/$p.html")
    if [ "$c" != 200 ]; then echo "FAIL $host/store/$p.html http=$c"; fail=1
    elif ! grep -q 'name="robots" content="noindex"' /tmp/vp.$$; then echo "FAIL $host/store/$p.html not noindex"; fail=1; fi
  done
  n=$(curl -s --max-time 20 -X POST -H 'Content-Type: application/json' -d '{"action":"list","limit":100}' "https://$host/store/products/" | grep -o '"slug"' | wc -l)
  echo "$host: $n products in /store/products/ list"
done
rm -f /tmp/vp.$$
[ $fail = 0 ] && echo "ALL PUBLIC CHECKS PASS" || { echo "PROBLEMS ABOVE"; exit 1; }