#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
ENV_FILE="${1:-"$ROOT_DIR/.env.staging"}"

if [[ ! -f "$ENV_FILE" ]]; then
  echo "Missing staging env file: $ENV_FILE" >&2
  exit 1
fi

set -a
# shellcheck disable=SC1090
source "$ENV_FILE"
set +a

failures=0

fail() {
  echo "FAIL: $*" >&2
  failures=$((failures + 1))
}

require_value() {
  local name="$1"
  local value="${!name:-}"

  if [[ -z "$value" ]]; then
    fail "$name is required"
  fi
}

require_secret() {
  local name="$1"
  local value="${!name:-}"

  require_value "$name"

  if [[ "$value" =~ change-me|local-dev|replace-with|example ]]; then
    fail "$name uses a placeholder/dev value"
  fi

  if [[ ${#value} -lt 32 ]]; then
    fail "$name must be at least 32 characters"
  fi
}

require_https_url() {
  local name="$1"
  local value="${!name:-}"

  require_value "$name"

  if [[ "$value" != https://* ]]; then
    fail "$name must use https://"
  fi
}

require_staging_domain() {
  local name="$1"
  local value="${!name:-}"

  require_value "$name"

  if [[ "$value" == *.local.nodedc || "$value" == "localhost" || "$value" == 127.* ]]; then
    fail "$name must not use local/dev domain"
  fi
}

require_value AUTH_DOMAIN
require_value LAUNCHER_DOMAIN
require_value TASK_DOMAIN
require_value STAGING_LAUNCHER_UPSTREAM
require_value STAGING_TASK_MANAGER_UPSTREAM
require_value AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS

require_staging_domain AUTH_DOMAIN
require_staging_domain LAUNCHER_DOMAIN
require_staging_domain TASK_DOMAIN

require_https_url LAUNCHER_OIDC_ISSUER
require_https_url LAUNCHER_OIDC_REDIRECT_URI
require_https_url LAUNCHER_OIDC_LOGGED_OUT_REDIRECT_URI
require_https_url PLANE_OIDC_ISSUER
require_https_url PLANE_OIDC_REDIRECT_URI

require_secret PG_PASS
require_secret AUTHENTIK_SECRET_KEY
require_secret SESSION_SECRET
require_secret NODEDC_INTERNAL_ACCESS_TOKEN
require_secret LAUNCHER_OIDC_CLIENT_SECRET
require_secret PLANE_OIDC_CLIENT_SECRET

if [[ "${COOKIE_SECURE:-}" != "true" ]]; then
  fail "COOKIE_SECURE must be true"
fi

if [[ "${COOKIE_DOMAIN:-}" == *.local.nodedc || "${COOKIE_DOMAIN:-}" == "localhost" ]]; then
  fail "COOKIE_DOMAIN must not use local/dev domain"
fi

if [[ "${NODEDC_INTERNAL_ACCESS_TOKEN:-}" == "${LAUNCHER_OIDC_CLIENT_SECRET:-}" ]]; then
  fail "NODEDC_INTERNAL_ACCESS_TOKEN must differ from LAUNCHER_OIDC_CLIENT_SECRET"
fi

if [[ "${NODEDC_INTERNAL_ACCESS_TOKEN:-}" == "${PLANE_OIDC_CLIENT_SECRET:-}" ]]; then
  fail "NODEDC_INTERNAL_ACCESS_TOKEN must differ from PLANE_OIDC_CLIENT_SECRET"
fi

if [[ "${LAUNCHER_OIDC_CLIENT_SECRET:-}" == "${PLANE_OIDC_CLIENT_SECRET:-}" ]]; then
  fail "Launcher and Tasker OIDC client secrets must differ"
fi

if [[ "${PLANE_NODEDC_ACCESS_TOKEN:-}" != "${NODEDC_INTERNAL_ACCESS_TOKEN:-}" ]]; then
  fail "PLANE_NODEDC_ACCESS_TOKEN must match NODEDC_INTERNAL_ACCESS_TOKEN"
fi

if [[ "${PLANE_NODEDC_ACCESS_ENFORCEMENT:-}" != "1" ]]; then
  fail "PLANE_NODEDC_ACCESS_ENFORCEMENT must be 1"
fi

if [[ "${PLANE_NODEDC_ACCESS_ENFORCE_UNLINKED:-}" != "1" ]]; then
  fail "PLANE_NODEDC_ACCESS_ENFORCE_UNLINKED must be 1"
fi

case "${AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS:-}" in
  *"0.0.0.0/0"*|*"::/0"*|*"10.0.0.0/8"*|*"172.16.0.0/12"*|*"192.168.0.0/16"*|*"127.0.0.0/8"*)
    fail "AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS must be limited to the actual reverse-proxy/ingress subnet"
    ;;
esac

if [[ $failures -gt 0 ]]; then
  echo "Staging env check failed with $failures issue(s)." >&2
  exit 1
fi

echo "Staging env check passed: $ENV_FILE"
