#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"

ENV_FILE="${ROOT_DIR}/.env"
DATA_DIR="${ROOT_DIR}/data"

if [[ ! -f "${ENV_FILE}" ]]; then
  echo "Missing .env: ${ENV_FILE}"
  exit 1
fi

require_key() {
  local key="$1"
  if ! grep -Eq "^[[:space:]]*${key}=" "${ENV_FILE}"; then
    echo "Missing required env var in .env: ${key}"
    exit 1
  fi
}

require_key "DATABASE_URL"
require_key "REDIS_URL"
require_key "JWT_SECRET"
require_key "AUTH_CODE_JWT_SECRET"

if grep -Eq "^[[:space:]]*PORT=" "${ENV_FILE}"; then
  port="$(grep -E "^[[:space:]]*PORT=" "${ENV_FILE}" | tail -n 1 | cut -d= -f2- | tr -d '\r' | tr -d '"')"
  if [[ -n "${port}" && ! "${port}" =~ ^[0-9]+$ ]]; then
    echo "PORT must be a number in .env (got: ${port})"
    exit 1
  fi
fi

if [[ "${DEPLOY_TARGET:-}" == "docker" ]]; then
  redis_url="$(grep -E "^[[:space:]]*REDIS_URL=" "${ENV_FILE}" | tail -n 1 | cut -d= -f2- | tr -d '\r')"
  if [[ "${redis_url}" == redis://localhost* || "${redis_url}" == redis://127.0.0.1* ]]; then
    echo "REDIS_URL cannot use localhost/127.0.0.1 for docker deployment: ${redis_url}"
    exit 1
  fi

  db_url="$(grep -E "^[[:space:]]*DATABASE_URL=" "${ENV_FILE}" | tail -n 1 | cut -d= -f2- | tr -d '\r')"
  if [[ "${db_url}" == *://localhost* || "${db_url}" == *://127.0.0.1* ]]; then
    echo "DATABASE_URL cannot use localhost/127.0.0.1 for docker deployment: ${db_url}"
    exit 1
  fi
fi

if [[ ! -f "${DATA_DIR}/jwt_private_key.pem" ]]; then
  echo "Missing key file: ${DATA_DIR}/jwt_private_key.pem"
  exit 1
fi
if [[ ! -f "${DATA_DIR}/jwt_public_key.pem" ]]; then
  echo "Missing key file: ${DATA_DIR}/jwt_public_key.pem"
  exit 1
fi

if [[ ! -s "${DATA_DIR}/jwt_private_key.pem" ]]; then
  echo "Empty key file: ${DATA_DIR}/jwt_private_key.pem"
  exit 1
fi
if [[ ! -s "${DATA_DIR}/jwt_public_key.pem" ]]; then
  echo "Empty key file: ${DATA_DIR}/jwt_public_key.pem"
  exit 1
fi

if grep -Eq "^[[:space:]]*JWT_PRIVATE_KEY_PEM=" "${ENV_FILE}" || grep -Eq "^[[:space:]]*JWT_PUBLIC_KEY_PEM=" "${ENV_FILE}"; then
  env_priv="$(grep -E "^[[:space:]]*JWT_PRIVATE_KEY_PEM=" "${ENV_FILE}" | tail -n 1 | cut -d= -f2- | tr -d '\r')"
  env_pub="$(grep -E "^[[:space:]]*JWT_PUBLIC_KEY_PEM=" "${ENV_FILE}" | tail -n 1 | cut -d= -f2- | tr -d '\r')"

  file_priv="$(cat "${DATA_DIR}/jwt_private_key.pem")"
  file_pub="$(cat "${DATA_DIR}/jwt_public_key.pem")"

  if [[ -n "${env_priv}" && "${env_priv}" != "${file_priv}" ]]; then
    echo "JWT_PRIVATE_KEY_PEM in .env does not match data/jwt_private_key.pem"
    exit 1
  fi
  if [[ -n "${env_pub}" && "${env_pub}" != "${file_pub}" ]]; then
    echo "JWT_PUBLIC_KEY_PEM in .env does not match data/jwt_public_key.pem"
    exit 1
  fi
fi

echo "iam-service .env validation OK"