#!/usr/bin/env bash
set -euo pipefail

# Validate the managed-production Control Panel handoff without printing secrets.
# This does not contact the enterprise IdP; it proves the host has the required
# TLS/OIDC files and that values are not still local/mock placeholders.

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
COMPOSE="${CASAN_CP_COMPOSE:-$ROOT/docker-compose.control-panel.yml}"
TLS_DIR="${CASAN_CP_TLS_DIR:-/opt/casan-control-panel/tls}"
OAUTH_ENV="${CASAN_CP_OAUTH_ENV:-/opt/casan-control-panel/oauth2-proxy.env}"

fail() {
  echo "CP_PROD_READINESS_FAIL $1"
  exit 1
}

pass() {
  echo "PASS: $1"
}

value_of() {
  local key="$1"
  sed -n -E "s/^${key}=//p" "$OAUTH_ENV" | tail -1
}

require_file() {
  local path="$1"
  [[ -f "$path" ]] || fail "missing_file path=$path"
  [[ -s "$path" ]] || fail "empty_file path=$path"
}

require_env() {
  local key="$1"
  local value
  value="$(value_of "$key")"
  [[ -n "$value" ]] || fail "missing_env key=$key file=$OAUTH_ENV"
  case "$value" in
    *replace-with*|*example.com*|*localhost*|*127.0.0.1*|*idp:8080*)
      fail "placeholder_env key=$key"
      ;;
  esac
}

docker compose -f "$COMPOSE" config >/tmp/casan-cp-prod-compose-config.txt
pass "docker compose config"

require_file "$TLS_DIR/tls.crt"
require_file "$TLS_DIR/tls.key"
openssl x509 -in "$TLS_DIR/tls.crt" -noout >/dev/null
pass "tls certificate/key present"

require_file "$OAUTH_ENV"
for key in \
  OAUTH2_PROXY_PROVIDER \
  OAUTH2_PROXY_OIDC_ISSUER_URL \
  OAUTH2_PROXY_CLIENT_ID \
  OAUTH2_PROXY_CLIENT_SECRET \
  OAUTH2_PROXY_COOKIE_SECRET \
  OAUTH2_PROXY_REDIRECT_URL \
  OAUTH2_PROXY_OIDC_GROUPS_CLAIM
do
  require_env "$key"
done

[[ "$(value_of OAUTH2_PROXY_PROVIDER)" == "oidc" ]] || fail "provider_must_be_oidc"
[[ "$(value_of OAUTH2_PROXY_COOKIE_SECURE)" == "true" ]] || fail "cookie_secure_must_be_true"
[[ "$(value_of OAUTH2_PROXY_SET_XAUTHREQUEST)" == "true" ]] || fail "xauthrequest_must_be_true"
[[ "$(value_of OAUTH2_PROXY_PASS_ACCESS_TOKEN)" == "false" ]] || fail "pass_access_token_must_be_false"
[[ "$(value_of OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER)" == "false" ]] || fail "pass_authorization_header_must_be_false"
[[ "$(value_of OAUTH2_PROXY_OIDC_ISSUER_URL)" == https://* ]] || fail "issuer_must_be_https"
[[ "$(value_of OAUTH2_PROXY_REDIRECT_URL)" == https://*"/oauth2/callback" ]] || fail "redirect_url_must_be_https_callback"
[[ "$(value_of OAUTH2_PROXY_OIDC_GROUPS_CLAIM)" == "groups" ]] || fail "groups_claim_must_be_groups"
pass "oauth2-proxy env"

tmp="$(mktemp -d)"
cp "$TLS_DIR/tls.crt" "$tmp/tls.crt"
cp "$TLS_DIR/tls.key" "$tmp/tls.key"
docker run --rm \
  --add-host oauth2-proxy:127.0.0.1 \
  --add-host control-panel-api:127.0.0.1 \
  -v "$ROOT/nginx/control-panel.conf:/etc/nginx/conf.d/default.conf:ro" \
  -v "$tmp:/etc/nginx/tls:ro" \
  nginx:1.27-alpine nginx -t >/tmp/casan-cp-prod-nginx-test.log 2>&1 || {
    cat /tmp/casan-cp-prod-nginx-test.log
    rm -rf "$tmp"
    fail "nginx_config"
  }
rm -rf "$tmp"
pass "nginx config"

echo "CP_PROD_READINESS_PASS compose=true tls=true oidc=true nginx=true"