"""Read-only checks of a deployed HTTPS host; never sends account email or writes data."""
import argparse,http.cookiejar,ssl,urllib.error,urllib.parse,urllib.request
parser=argparse.ArgumentParser();parser.add_argument('url');args=parser.parse_args()
url=args.url.rstrip('/');parts=urllib.parse.urlsplit(url)
if parts.scheme!='https' or parts.query or parts.fragment or parts.username:raise SystemExit('Use the trusted HTTPS application base URL.')
client=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),urllib.request.HTTPSHandler(context=ssl.create_default_context()))
def get(path):
    try:
        with client.open(url+'/'+path,timeout=25) as response:return response.status,response.headers,response.read(),response.geturl()
    except urllib.error.HTTPError as error:return error.code,error.headers,error.read(),error.geturl()
failures=[]
status,headers,body,final=get('main.php')
if status!=200 or urllib.parse.urlsplit(final).scheme!='https':failures.append('HTTPS login page unavailable.')
for name in ['Strict-Transport-Security','Content-Security-Policy','X-Content-Type-Options','Referrer-Policy','X-Frame-Options']:
    if not headers.get(name):failures.append('Missing '+name)
cookie=';'.join(headers.get_all('Set-Cookie') or [])
if not all(flag in cookie.lower() for flag in ['secure','httponly','samesite=lax']):failures.append('Session cookie flags are missing.')
for path in ['xml/settings.local.xml','xml/settings.xml','.tools/backups/probe.sql','.git/config','vendor/autoload.php','bin/migrate-production.php','classes/Base.php','tests/http_fixture.php','composer.lock','release-manifest.json']:
    if get(path)[0] not in [403,404]:failures.append('Private path was not denied: '+path)
for failure in failures:print('FAIL: '+failure)
if failures:raise SystemExit(1)
print('HTTPS, security headers, cookies, and private-path checks passed. Verify inbox delivery and operational jobs separately.')