#!/usr/bin/env bash
# Production post-deploy smoke test — deliberately read-only/non-destructive (never creates
# real students/cohorts against production data). Confirms the deployed services are actually
# up after a deploy/rollback, before calling the deploy "done."
set -euo pipefail

PROD_URL="${PRODUCTION_URL:?set PRODUCTION_URL, e.g. https://academy.example.com}"

echo "==> Gateway health"
curl -sf "$PROD_URL/healthz" > /dev/null && echo "OK"

echo "==> TLS certificate is valid and not expiring soon"
EXPIRY=$(echo | openssl s_client -connect "$(echo "$PROD_URL" | sed -e 's#https://##')":443 -servername "$(echo "$PROD_URL" | sed -e 's#https://##')" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
echo "Certificate expires: $EXPIRY"

echo "==> Roster endpoint responds (public, unauthenticated, read-only)"
curl -sf "$PROD_URL/api/roster/cohorts" > /dev/null && echo "OK"

echo "==> Admin login page loads (does not attempt to log in)"
curl -sf "$PROD_URL/admin" -o /dev/null -w '%{http_code}\n' | grep -q 200 && echo "OK"

echo
echo "OK: production smoke test passed. For a full functional check (owner/instructor login,"
echo "cohort, Prepare Labs, student flow, assessment, Capstone), work through"
echo "docs/PRODUCTION_VALIDATION_CHECKLIST.md's ACADEMY section manually — deliberately not"
echo "automated against real production data."