#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"

rg -F 'qualified Env' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
rg -F 'qualified Text.URI' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
rg -F 'newtype Secret value = Secret value' \
  "$ROOT/src/Nuthatch/Config.hs" >/dev/null
if rg -n 'lookupEnv|parseURI|splitOn.*://' \
    "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
  printf 'configuration bypasses maintained parsers\n' >&2
  exit 1
fi
if rg -n 'Secret.*deriving.*Show|data Config.*deriving.*Show' \
    "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
  printf 'secret-bearing configuration has a revealing Show instance\n' >&2
  exit 1
fi
for secret_type in \
    SessionToken CsrfToken AuthorizationRequest TransactionClaims IdTokenClaims; do
  if sed -n \
      "/^\\(newtype\\|data\\) $secret_type /,/^$/p" \
      "$ROOT/src/Nuthatch/Types.hs" "$ROOT/src/Nuthatch/Oidc.hs" |
      rg 'deriving stock .*Show' >/dev/null; then
    printf 'secret-bearing application value has a Show instance\n' >&2
    exit 1
  fi
done
printf 'Runtime configuration structure passed\n'