#!/usr/bin/env bash
# Production post-deploy smoke test — deliberately read-only/non-destructive (never creates
# real students/cohorts against production data). Confirms the deployed services are actually
# up after a deploy/rollback, before calling the deploy "done."
set -euo pipefail

PROD_URL="${PRODUCTION_URL:?set PRODUCTION_URL, e.g. https://academy.example.com}"

# Phase 4.1 §23: every `curl ... && echo "OK"` below used to be one statement — under `set -e`,
# a failing command that isn't the LAST one in an && list does not trigger the shell to exit (a
# well-known bash gotcha), so an unreachable/broken production endpoint used to fall through
# silently instead of failing this script. Split into two statements each, so the real exit
# status is what `set -e` sees. Found by infra/scripts/drills/test-ci-fails-closed.sh.
echo "==> Gateway health"
curl -sf "$PROD_URL/healthz" > /dev/null
echo "OK"

echo "==> TLS certificate is valid and not expiring soon"
EXPIRY=$(echo | openssl s_client -connect "$(echo "$PROD_URL" | sed -e 's#https://##')":443 -servername "$(echo "$PROD_URL" | sed -e 's#https://##')" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
echo "Certificate expires: $EXPIRY"

echo "==> Roster endpoint responds (public, unauthenticated, read-only)"
curl -sf "$PROD_URL/api/roster/cohorts" > /dev/null
echo "OK"

echo "==> Admin login page loads (does not attempt to log in)"
curl -sf "$PROD_URL/admin" -o /dev/null -w '%{http_code}\n' | grep -q 200
echo "OK"

echo
echo "OK: production smoke test passed. For a full functional check (owner/instructor login,"
echo "cohort, Prepare Labs, student flow, assessment, Capstone), work through"
echo "docs/PRODUCTION_VALIDATION_CHECKLIST.md's ACADEMY section manually — deliberately not"
echo "automated against real production data."