Group configuration by component ownership

tests/runtime-static.sh

@@ -12,11 +12,44 @@ if rg -n 'lookupEnv|parseURI|splitOn.*://' \
   printf 'configuration bypasses maintained parsers\n' >&2
   exit 1
 fi
-if rg -n 'Secret.*deriving.*Show|data Config.*deriving.*Show' \
-    "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
-  printf 'secret-bearing configuration has a revealing Show instance\n' >&2
+for secret_group in \
+    Secret Config HttpConfig OidcConfig PostgresConfig S3Config; do
+  if sed -n "/^\\(data\\|newtype\\) $secret_group /,/^$/p" \
+      "$ROOT/src/Nuthatch/Config.hs" |
+      rg '\bShow\b' >/dev/null; then
+    printf 'secret-bearing configuration has a revealing Show instance\n' >&2
+    exit 1
+  fi
+done
+config_fields="$(
+  sed -n '/^data Config /,/^$/p' "$ROOT/src/Nuthatch/Config.hs" |
+    sed -nE \
+      's/^[[:space:]]*[\{,][[:space:]]*(cfg[A-Za-z0-9_]+).*/\1/p'
+)"
+expected_config_fields='cfgRuntime
+cfgHttp
+cfgOidc
+cfgPostgres
+cfgRedis
+cfgS3
+cfgProduct
+cfgRecovery'
+if [[ "$config_fields" != "$expected_config_fields" ]]; then
+  printf 'top-level configuration does not contain exactly eight groups\n' >&2
   exit 1
 fi
+if rg -F 'Nuthatch.Streaming' "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
+  printf 'configuration depends on streaming implementation details\n' >&2
+  exit 1
+fi
+rg -F 'withDb :: PostgresConfig' "$ROOT/src/Nuthatch/Db.hs" >/dev/null
+rg -F 'withRedis :: RedisConfig' "$ROOT/src/Nuthatch/Redis.hs" >/dev/null
+rg -F 'throttleCheck :: Redis -> RedisConfig' \
+  "$ROOT/src/Nuthatch/Redis.hs" >/dev/null
+rg -F 'newS3 :: S3Config' "$ROOT/src/Nuthatch/S3.hs" >/dev/null
+rg -F 'mintSession :: HttpConfig' "$ROOT/src/Nuthatch/Session.hs" >/dev/null
+rg -F 'verifySession :: HttpConfig' "$ROOT/src/Nuthatch/Session.hs" >/dev/null
+rg -F 'beginAuthorization :: OidcConfig' "$ROOT/src/Nuthatch/Oidc.hs" >/dev/null
 for secret_type in \
     SessionToken CsrfToken AuthorizationRequest TransactionClaims IdTokenClaims; do
   if sed -n \