#!/usr/bin/env bash
set -euo pipefail

cd "$(dirname "$0")/.."

document=docs/spec/contracts.md
test -f "$document"

for heading in \
  "## HTTP contract" \
  "## SQL contract" \
  "## Identity encoding contract" \
  "## Content identity contract" \
  "## Environment contract" \
  "## Supported-store contract" \
  "## Deployment authority contract"; do
  grep -Fx "$heading" "$document" >/dev/null
done

for ownership in \
  '| HTTP | `src/Nuthatch/Api.hs`, `src/Nuthatch/App.hs` | `make check-product` |' \
  '| SQL | `sql/`, `src/Nuthatch/Db.hs`, `src/Nuthatch/Protocol.hs` | `make check-storage-foundation` |' \
  '| Identity encoding | `src/Nuthatch/Paths.hs` | `make test` |' \
  '| Content identity | `src/Nuthatch/Streaming.hs`, `src/Nuthatch/S3.hs` | `make check-streaming` |' \
  '| Environment | `src/Nuthatch/Config.hs` | `make check-runtime` |' \
  '| Supported store | `src/Nuthatch/S3.hs` | `make check-protocol` |' \
  '| Deployment authority | Deployment object-store IAM/policy; secret injection in `deploy/kubernetes/nuthatch.yaml.in` | `make check-auth` |'; do
  grep -Fx "$ownership" "$document" >/dev/null
done

for path in \
  src/Nuthatch/Api.hs \
  src/Nuthatch/App.hs \
  src/Nuthatch/Config.hs \
  src/Nuthatch/Db.hs \
  src/Nuthatch/Paths.hs \
  src/Nuthatch/Protocol.hs \
  src/Nuthatch/S3.hs \
  src/Nuthatch/Streaming.hs \
  sql/001_initial_schema.sql \
  deploy/kubernetes/nuthatch.yaml.in \
  tests/kind/lib.sh \
  tests/kind/product-matrix-job.yaml.in; do
  test -e "$path"
  grep -F "$path" "$document" >/dev/null
done

if grep -Eiq '\b(TODO|TBD|unresolved|open question)\b' "$document"; then
  printf '%s\n' "Durable contracts contain an unresolved marker" >&2
  exit 1
fi

grep -F 'e0240ab33521a1882fb647a79f7fd3c74c9b6348b29bdb14e572204517882859' "$document" >/dev/null
grep -F 'Authenticated `/api/session`, `/api/browse`, `/api/download`' "$document" >/dev/null
if grep -Fq '/nuthatch.js' "$document"; then
  printf '%s\n' "Durable contracts contain a removed browser bridge" >&2
  exit 1
fi
grep -F '`nuthatch-sha256`' "$document" >/dev/null
grep -F '`x-amz-meta-nuthatch-sha256`' "$document" >/dev/null
grep -F 'always streams the full body and computes its digest' "$document" >/dev/null
grep -F '`NUTHATCH_JWT_SECRET` contains at least 32 UTF-8 bytes.' "$document" >/dev/null
grep -F '`NUTHATCH_COOKIE_NAME`, `NUTHATCH_CSRF_COOKIE_NAME`, and' "$document" >/dev/null
grep -F '`NUTHATCH_OIDC_ADDITIONAL_AUDIENCES`' "$document" >/dev/null
grep -F '`users/` and `shared/`' "$document" >/dev/null
grep -F 'only for' "$document" >/dev/null
grep -F '`NUTHATCH_S3_BUCKET`' "$document" >/dev/null
grep -F 'authority over other buckets' "$document" >/dev/null
grep -F 'exclusive writer' "$document" >/dev/null
grep -F "object-store IAM or policy system enforces that scope" "$document" >/dev/null
grep -F "verifies denial against a different" "$document" >/dev/null
grep -F 'They are not product requirements' "$document" >/dev/null

printf '%s\n' "Durable implementation contracts passed"