#!/usr/bin/env python3
"""No business mutations; inspect only status and non-sensitive response shape."""
import json, ssl, urllib.request, urllib.error
from pathlib import Path
ROOT=Path(__file__).resolve().parents[1]
evidence=ROOT/'.local/uat-deploy/evidence'
ctx=ssl.create_default_context(cafile=str(evidence/'server.crt'))
base='https://192.168.68.223:8445/syly/'
results=[]
cases=[
    ('login-page','',200,'formLogin'),
    ('login-controller','loginController.do?login',200,'formLogin'),
    ('captcha','randCodeImage',200,None),
    ('anonymous-business','hotelController.do?datagrid',401,None),
    ('repair-disabled','repairController.do?uat_probe',403,None),
    ('password-reset-disabled','userController.do?savenewpwdforuser',403,None),
    ('mobile-disabled','appservice.do?uat_probe',403,None),
    ('sync-disabled','hoteldataupdatecontroller.do?uat_probe',403,None),
    ('druid-disabled','webpage/system/druid/index.html',403,None),
    ('upload-disabled','plug-in/ckfinder/core/connector/java/connector.java',403,None),
    ('rest-disabled','rest/uat_probe',403,None),
    ('backup-account-login-disabled','loginController.do?checkuser&userName=admin',200,'UAT permits only'),
]
for name,path,expected,marker in cases:
    req=urllib.request.Request(base+path,headers={'User-Agent':'syly2-uat-deployment-verification'})
    try: res=urllib.request.urlopen(req,context=ctx,timeout=45)
    except urllib.error.HTTPError as e: res=e
    body=res.read(1024*1024)
    ok=res.status==expected and (marker is None or marker.encode() in body)
    if name=='captcha': ok=ok and body.startswith(b'\xff\xd8')
    results.append({'check':name,'status':res.status,'expected_status':expected,'passed':ok,'bytes':len(body)})
(evidence/'http-checks.json').write_text(json.dumps(results,indent=2))
print(json.dumps(results,indent=2))
assert all(x['passed'] for x in results)