/**
 * Loopback run evidence detail route.
 *
 * GET /workspaces/{ws}/runs/{runId}/evidence — bounded evidence payload
 * including per-file patch content (base64-encoded snapshots captured
 * during the run lifecycle).
 *
 * Behind bridge:read scope (via the route table) and workspace authorization.
 * The response passes through the public-identifier leak guard; per-file
 * content was already sanitized at capture time (looksSecret), and the
 * envelope is verified again here.
 */
import { authorizeWorkspace } from "./authGuards.js";
import { PUBLIC_IDENTIFIER_SCAN_OPTIONS, writeJson } from "./publicResponse.js";
import { firstCapture, matchPath } from "./routeMatching.js";
const RUN_EVIDENCE_SCAN_OPTIONS = {
    allowedFieldNames: [
        ...PUBLIC_IDENTIFIER_SCAN_OPTIONS.allowedFieldNames,
        "added",
        "change",
        "changedFiles",
        "command",
        "contentBase64",
        "contentSha256",
        "createdAt",
        "durationMs",
        "exitCode",
        "kind",
        "label",
        "patchFiles",
        "path",
        "reasonCode",
        "removed",
        "severity",
        "status",
        "updatedAt",
        "validations",
        "verdict",
        "warnings",
    ],
};
export async function handleEvidenceRoute(context) {
    const { app, auth, request, response, url } = context;
    if (request.method !== "GET")
        return false;
    const match = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/runs\/([^/]+)\/evidence$/);
    if (!match)
        return false;
    const workspaceId = firstCapture(match);
    if (!authorizeWorkspace(response, auth, workspaceId))
        return true;
    const runId = match[1] ?? "";
    const run = app.localStore.findRun(runId);
    if (!run || run.workspaceId !== workspaceId) {
        writeJson(response, 404, {
            error: "not_found",
            message: "Run evidence not found.",
        });
        return true;
    }
    const evidence = app.localStore.findRunEvidence(runId);
    if (!evidence) {
        writeJson(response, 404, {
            error: "not_found",
            message: "Run evidence not found.",
        });
        return true;
    }
    writeJson(response, 200, evidence, {
        surface: "workspace.runs.evidence",
        scanOptions: RUN_EVIDENCE_SCAN_OPTIONS,
    });
    return true;
}
