#!/usr/bin/env sh
set -eu

assert_contains() {
  file="$1"
  pattern="$2"
  if ! grep -Fq "$pattern" "$file"; then
    echo "missing pattern in $file: $pattern" >&2
    exit 1
  fi
}

assert_not_contains() {
  file="$1"
  pattern="$2"
  if grep -Fq "$pattern" "$file"; then
    echo "forbidden pattern in $file: $pattern" >&2
    exit 1
  fi
}

staging_pull=".gitea/workflows/staging_code_pull.yml"
pull_compose="docker/staging_pull_compose.template.yaml"
deploy_compose="deploy/templates/docker-compose.yaml"
userfront_dockerfile="userfront/Dockerfile"
devfront_vite="devfront/vite.config.ts"
orgfront_vite="orgfront/vite.config.ts"
adminfront_vite="adminfront/vite.config.ts"
adminfront_runtime="adminfront/scripts/runtime-mode.sh"
devfront_runtime="devfront/scripts/runtime-mode.sh"
orgfront_runtime="orgfront/scripts/runtime-mode.sh"

for file in \
  "$staging_pull" \
  "$pull_compose" \
  "$deploy_compose" \
  "$userfront_dockerfile" \
  "$adminfront_vite" \
  "$devfront_vite" \
  "$orgfront_vite" \
  "$adminfront_runtime" \
  "$devfront_runtime" \
  "$orgfront_runtime"
do
  if [ ! -f "$file" ]; then
    echo "missing expected file: $file" >&2
    exit 1
  fi
done

for workflow in "$staging_pull"; do
  assert_contains "$workflow" 'ADMINFRONT_URL=${{ vars.ADMINFRONT_URL }}'
  assert_contains "$workflow" 'DEVFRONT_URL=${{ vars.DEVFRONT_URL }}'
  assert_contains "$workflow" 'ORGFRONT_URL=${{ vars.ORGFRONT_URL }}'
  assert_contains "$workflow" 'KRATOS_ALLOWED_RETURN_URLS_JSON=${{ vars.KRATOS_ALLOWED_RETURN_URLS_JSON }}'
  assert_contains "$workflow" 'KRATOS_ALLOWED_RETURN_URLS_EXTRA=${{ vars.KRATOS_ALLOWED_RETURN_URLS_EXTRA }}'
done

assert_contains "$staging_pull" 'bash scripts/render_ory_config.sh'
assert_contains "$staging_pull" 'chmod -R 777 config/.generated/ory'
assert_contains "$staging_pull" 'docker compose -f staging_pull_compose.yaml build --pull'
assert_contains "$staging_pull" 'docker compose -f staging_pull_compose.yaml up -d --remove-orphans --renew-anon-volumes'

assert_contains "$userfront_dockerfile" "FROM ghcr.io/cirruslabs/flutter:3.38.0 AS build"
assert_contains "$userfront_dockerfile" "RUN flutter build web --release --wasm"
assert_contains "$userfront_dockerfile" "FROM alpine:3.23 AS production"
assert_contains "$pull_compose" "baron_devfront"
assert_contains "$pull_compose" "baron_orgfront"
assert_contains "$pull_compose" "dockerfile: userfront/Dockerfile"
assert_not_contains "$pull_compose" 'target: ${USERFRONT_BUILD_TARGET:-dev}'
assert_not_contains "$pull_compose" "target: dev"
assert_not_contains "$pull_compose" "flutter run"
assert_contains "$pull_compose" "http://127.0.0.1:5173/"
assert_contains "$pull_compose" "http://127.0.0.1:5175/"
assert_contains "$pull_compose" 'APP_ENV=${APP_ENV:-stage}'

assert_contains "$deploy_compose" "sh ./scripts/runtime-mode.sh"
assert_not_contains "$deploy_compose" "command: npm run dev"

assert_contains "$adminfront_vite" "/tmp/baron-sso-adminfront-dist"
assert_contains "$adminfront_vite" "/tmp/baron-sso-adminfront-vite-cache"
assert_contains "adminfront/biome.json" '".vite"'
assert_contains "adminfront/tsconfig.app.json" '"exclude": ["src/**/*.test.ts", "src/**/*.test.tsx"]'
assert_contains "$devfront_vite" "/tmp/baron-sso-devfront-dist"
assert_contains "$devfront_vite" "/tmp/baron-sso-devfront-vite-cache"
assert_contains "$devfront_vite" "hostFromUrl(process.env.DEVFRONT_URL)"
assert_contains "$devfront_vite" "process.env.DEVFRONT_ALLOWED_HOSTS"
assert_contains "devfront/biome.json" '".vite"'
assert_contains "devfront/tsconfig.app.json" '"exclude": ["src/**/*.test.ts", "src/**/*.test.tsx"]'
assert_contains "$orgfront_vite" "/tmp/baron-sso-orgfront-dist"
assert_contains "$orgfront_vite" "/tmp/baron-sso-orgfront-vite-cache"
assert_contains "$orgfront_vite" '"sorg.hmac.kr"'
assert_contains "orgfront/biome.json" '".vite"'
assert_contains "orgfront/tsconfig.app.json" '"exclude": ["src/**/*.test.ts", "src/**/*.test.tsx"]'

for runtime_script in "$adminfront_runtime" "$devfront_runtime" "$orgfront_runtime"; do
  assert_contains "$runtime_script" "ensure_frontend_dependencies"
  assert_contains "$runtime_script" "package-lock.json"
  assert_contains "$runtime_script" "npm ci"
  assert_contains "$runtime_script" ".baron-deps-hash"
done

echo "staging frontend deploy policy checks passed"
