#!/usr/bin/env bash
# verify.sh - the checks that would have caught every false result today.
#
# Every rule here comes from a real wrong answer on 2026-08-13:
#   1. A regex found ".cta__b" in the STYLESHEET and I reported the element as
#      live on the page. Three times (site stylesheet, header mark, session
#      note). Fix: count needles only OUTSIDE <style> and <script>.
#   2. A single fetch confirmed a badge that rendered on only one code path.
#      Fix: three consecutive fetches; byte counts must agree.
#   3. Byte-identical output across deploys was read as "the deploy failed"
#      when it meant "a cache is answering". Fix: compare against the previous
#      run and say CACHE, not deploy.
#   4. The container got 12KB challenge pages and I reported them as the site.
#      Fix: refuse to judge a small body carrying challenge language.
#   5. The owner saw no badge because he was logged in. Fix: always state that
#      this is the ANONYMOUS view - the only one a crawler ever gets.
set -u
URL="${1:?usage: verify.sh <url> [needle ...]}"; shift || true
UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126 Safari/537.36'
TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
echo "  $URL"
echo "  vantage: anonymous, no cookies - the only view a crawler gets"
sizes=(); ok=1
for i in 1 2 3; do
  code=$(curl -s -A "$UA" -o "$TMP/$i" -w '%{http_code}' "$URL")
  n=$(wc -c < "$TMP/$i" | tr -d ' ')
  sizes+=("$n")
  if [ "$n" -lt 20000 ] && grep -qiE 'one moment, please|being verified|checking your browser' "$TMP/$i"; then
    echo "  X REFUSING TO JUDGE: ${n}B challenge page, not the site."
    echo "    This vantage point is being challenged. Measure from somewhere else."
    exit 3
  fi
  [ "$code" = "200" ] || { echo "  X HTTP $code on try $i"; ok=0; }
  sleep 3
done
if [ "${sizes[0]}" = "${sizes[1]}" ] && [ "${sizes[1]}" = "${sizes[2]}" ]; then
  echo "  OK stable across 3 fetches (${sizes[0]}B)"
else
  echo "  ! UNSTABLE: ${sizes[*]} - output differs between requests."
  echo "    Something is conditional. One fetch proves nothing here."
  ok=0
fi
key=$(printf '%s' "$URL" | tr -c 'a-zA-Z0-9' '_')
prev="/tmp/verify_prev_$key"
if [ -f "$prev" ] && [ "$(cat "$prev")" = "${sizes[0]}" ]; then
  echo "  ! byte-identical to the previous run - if you just deployed, that is a"
  echo "    CACHE answering, not a failed deploy. Purge, then re-check."
fi
printf '%s' "${sizes[0]}" > "$prev"
for needle in "$@"; do
  python3 - "$TMP/1" "$needle" <<'PY'
import re, sys
body = open(sys.argv[1], encoding="utf-8", errors="replace").read()
needle = sys.argv[2]
stripped = re.sub(r'<(script|style)\b[^>]*>[\s\S]*?</\1>', ' ', body, flags=re.I)
n_all, n_markup = body.count(needle), stripped.count(needle)
print("  %s %-30s markup:%d  raw:%d" % ("OK" if n_markup else "X ", needle[:30], n_markup, n_all))
if n_all and not n_markup:
    print("      ^ MATCHED ONLY INSIDE <style>/<script>. This exact false positive")
    print("        reported three features as live today. It is NOT on the page.")
PY
done
echo "  note: anonymous view. Logged in you will see a different page - plugins"
echo "        routinely skip output filters for signed-in users."
[ "$ok" = "1" ] && echo "  RESULT: consistent" || echo "  RESULT: NOT verified"