$ErrorActionPreference = 'Stop'
$allowed = @('MIT', 'BSD-2-Clause', 'BSD-3-Clause', 'Apache-2.0', 'ISC', '0BSD')
$seen = @{}
foreach ($lockPath in (Get-ChildItem -LiteralPath $PSScriptRoot -Filter packages.lock.json -Recurse)) {
    $lock = Get-Content -Raw -LiteralPath $lockPath.FullName | ConvertFrom-Json
    $assets = Get-Content -Raw -LiteralPath (Join-Path $lockPath.DirectoryName 'obj/project.assets.json') | ConvertFrom-Json
    foreach ($framework in $lock.dependencies.PSObject.Properties) {
        foreach ($package in $framework.Value.PSObject.Properties) {
            if ($package.Value.type -eq 'Project') { continue }
            $id = $package.Name.ToLowerInvariant()
            $version = $package.Value.resolved
            if ($seen.ContainsKey("$id/$version")) { continue }
            $seen["$id/$version"] = $true
            $nuspec = $null
            foreach ($folder in $assets.packageFolders.PSObject.Properties.Name) {
                $candidate = Join-Path $folder "$id/$version/$id.nuspec"
                if (Test-Path -LiteralPath $candidate) { $nuspec = $candidate; break }
            }
            if (!$nuspec) { throw "Restore dependencies before auditing $id/$version." }
            [xml]$spec = Get-Content -Raw -LiteralPath $nuspec
            $license = $spec.package.metadata.license
            if ($license.type -eq 'expression' -and $allowed -contains $license.InnerText) { continue }
            # This legacy pinned package predates NuGet license expressions (Apache-2.0).
            if ($id -eq 'xunit.abstractions' -and $version -eq '2.0.3' -and
                $spec.package.metadata.licenseUrl -eq 'https://raw.githubusercontent.com/xunit/xunit/master/license.txt') { continue }
            throw "Unapproved license for $id/$version. Review before changing the allowlist."
        }
    }
}
Write-Output "Checked $($seen.Count) package licenses: permissive allowlist passed."