// Direct curl-style probe through the live nginx of every endpoint canvas's
// frontend code calls. Goal: prove which ones return real EA2 JSON vs 502.
import { writeFileSync, mkdirSync } from "node:fs";

const OUT = "/tmp/canvas-evidence";
mkdirSync(OUT, { recursive: true });

const ROOT = "https://canvas.flow-master.ai";
const endpoints = [
  ["GET", "/api/v1/auth/dev-login-config", null],
  ["POST", "/api/v1/auth/dev-login", { email: "dev@flow-master.ai" }],
  ["GET", "/api/v1/auth/me", null],
  ["GET", "/api/v1/auth/microsoft/login", null],
  ["GET", "/api/ea2/work-items", null],
  ["GET", "/api/ea2/flow/processes?limit=10", null],
  ["GET", "/api/ea2/process-definitions", null],
  ["GET", "/api/runtime/transactions", null],
];

const out = [];
let token = null;

for (const [method, path, body] of endpoints) {
  const headers = { "content-type": "application/json" };
  if (token) headers["authorization"] = `Bearer ${token}`;
  const init = { method, headers };
  if (body) init.body = JSON.stringify(body);
  try {
    const res = await fetch(`${ROOT}${path}`, init);
    const text = await res.text();
    const sample = text.slice(0, 200).replace(/\s+/g, " ");
    let json = null;
    try { json = JSON.parse(text); } catch { /* not json */ }
    if (path === "/api/v1/auth/dev-login" && json?.access_token) token = json.access_token;
    out.push({ method, path, status: res.status, len: text.length, sample, ctype: res.headers.get("content-type") });
    console.log(`${method.padEnd(4)} ${path.padEnd(46)} ${res.status}  ${sample.slice(0, 80)}`);
  } catch (e) {
    out.push({ method, path, error: e.message });
    console.log(`${method.padEnd(4)} ${path.padEnd(46)} ERR  ${e.message}`);
  }
}

writeFileSync(`${OUT}/endpoint-probe.json`, JSON.stringify(out, null, 2));
console.log(`\n→ ${OUT}/endpoint-probe.json`);