#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"

rg -F 'qualified Env' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
rg -F 'qualified Text.URI' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
rg -F 'newtype Secret value = Secret value' \
  "$ROOT/src/Nuthatch/Config.hs" >/dev/null
if rg -n 'lookupEnv|parseURI|splitOn.*://' \
    "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
  printf 'configuration bypasses maintained parsers\n' >&2
  exit 1
fi
for secret_group in \
    Secret Config HttpConfig OidcConfig PostgresConfig S3Config; do
  if sed -n "/^\\(data\\|newtype\\) $secret_group /,/^$/p" \
      "$ROOT/src/Nuthatch/Config.hs" |
      rg '\bShow\b' >/dev/null; then
    printf 'secret-bearing configuration has a revealing Show instance\n' >&2
    exit 1
  fi
done
config_fields="$(
  sed -n '/^data Config /,/^$/p' "$ROOT/src/Nuthatch/Config.hs" |
    sed -nE \
      's/^[[:space:]]*[\{,][[:space:]]*(cfg[A-Za-z0-9_]+).*/\1/p'
)"
expected_config_fields='cfgRuntime
cfgHttp
cfgOidc
cfgPostgres
cfgRedis
cfgS3
cfgProduct
cfgRecovery'
if [[ "$config_fields" != "$expected_config_fields" ]]; then
  printf 'top-level configuration does not contain exactly eight groups\n' >&2
  exit 1
fi
if rg -F 'Nuthatch.Streaming' "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
  printf 'configuration depends on streaming implementation details\n' >&2
  exit 1
fi
rg -F 'withDb :: PostgresConfig' "$ROOT/src/Nuthatch/Db.hs" >/dev/null
rg -F 'withRedis :: RedisConfig' "$ROOT/src/Nuthatch/Redis.hs" >/dev/null
rg -F 'throttleCheck :: Redis -> RedisConfig' \
  "$ROOT/src/Nuthatch/Redis.hs" >/dev/null
rg -F 'newS3 :: S3Config' "$ROOT/src/Nuthatch/S3.hs" >/dev/null
rg -F 'mintSession :: HttpConfig' "$ROOT/src/Nuthatch/Session.hs" >/dev/null
rg -F 'verifySession :: HttpConfig' "$ROOT/src/Nuthatch/Session.hs" >/dev/null
rg -F 'beginAuthorization :: OidcConfig' "$ROOT/src/Nuthatch/Oidc.hs" >/dev/null
for secret_type in \
    SessionToken CsrfToken AuthorizationRequest TransactionClaims IdTokenClaims; do
  if sed -n \
      "/^\\(newtype\\|data\\) $secret_type /,/^$/p" \
      "$ROOT/src/Nuthatch/Types.hs" "$ROOT/src/Nuthatch/Oidc.hs" |
      rg 'deriving stock .*Show' >/dev/null; then
    printf 'secret-bearing application value has a Show instance\n' >&2
    exit 1
  fi
done
printf 'Runtime configuration structure passed\n'