name: API smoke

on:
  schedule:
    - cron: "*/30 * * * *"   # every 30 minutes
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - ".github/workflows/api-smoke.yml"

jobs:
  healthz:
    runs-on: ubuntu-latest
    steps:
      - name: GET /v1/healthz
        run: |
          RESPONSE=$(curl --fail --max-time 30 https://api.webhook-relay.dcsuniverse.com/v1/healthz)
          echo "Response: $RESPONSE"
          echo "$RESPONSE" | jq -e '.status == "healthy"' > /dev/null

      - name: Docs site reachable
        run: |
          curl --fail --max-time 30 --output /dev/null https://webhook-relay.dcsuniverse.com/

      - name: OpenAPI spec served
        run: |
          curl --fail --max-time 30 --output /dev/null https://webhook-relay.dcsuniverse.com/openapi.yaml
          curl --fail --max-time 30 --output /dev/null https://webhook-relay.dcsuniverse.com/openapi.json

      - name: 401 on protected endpoint without auth
        run: |
          STATUS=$(curl --silent --output /dev/null --write-out "%{http_code}" https://api.webhook-relay.dcsuniverse.com/v1/events)
          [ "$STATUS" = "401" ] || (echo "Expected 401, got $STATUS" && exit 1)

      - name: CORS allow-origin present for docs host
        run: |
          ORIGIN=$(curl --silent --include -X OPTIONS \
            -H "Origin: https://webhook-relay.dcsuniverse.com" \
            -H "Access-Control-Request-Method: POST" \
            https://api.webhook-relay.dcsuniverse.com/v1/events \
            | grep -i "^access-control-allow-origin")
          echo "$ORIGIN" | grep -q "webhook-relay.dcsuniverse.com" \
            || (echo "Missing/wrong Access-Control-Allow-Origin: $ORIGIN" && exit 1)