#!/usr/bin/env bash
# Foxhunt - Runpod Credential Validation Script
# Validates that credentials are properly configured for deployment
#
# Usage: ./validate_credentials.sh [path/to/.env.runpod]

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Default .env file path
ENV_FILE="${1:-.env.runpod}"

# Validation counters
PASSED=0
FAILED=0
WARNINGS=0

# Print header
echo "========================================"
echo "Foxhunt Runpod Credential Validation"
echo "========================================"
echo ""

# Check if .env file exists
echo -n "Checking if ${ENV_FILE} exists... "
if [[ -f "${ENV_FILE}" ]]; then
    echo -e "${GREEN}✓${NC}"
    ((PASSED++))
else
    echo -e "${RED}✗${NC}"
    echo -e "${RED}ERROR: ${ENV_FILE} not found${NC}"
    echo ""
    echo "Create the file with:"
    echo "  cat > ${ENV_FILE} <<EOF"
    echo "  POSTGRES_PASSWORD=\"\$(openssl rand -base64 32)\""
    echo "  VAULT_TOKEN=\"\$(openssl rand -base64 32)\""
    echo "  DATABENTO_API_KEY=\"YOUR_DATABENTO_API_KEY_HERE\""
    echo "  JWT_SECRET=\"\$(openssl rand -base64 64)\""
    echo "  EOF"
    echo "  chmod 600 ${ENV_FILE}"
    exit 1
fi

# Check file permissions (should be 600 or 400)
echo -n "Checking file permissions... "
PERMS=$(stat -c %a "${ENV_FILE}" 2>/dev/null || stat -f %Lp "${ENV_FILE}" 2>/dev/null)
if [[ "${PERMS}" == "600" ]] || [[ "${PERMS}" == "400" ]]; then
    echo -e "${GREEN}✓${NC} (${PERMS})"
    ((PASSED++))
else
    echo -e "${YELLOW}⚠${NC} (${PERMS} - should be 600 or 400)"
    echo "  Fix with: chmod 600 ${ENV_FILE}"
    ((WARNINGS++))
fi

# Required credentials
REQUIRED_CREDS=(
    "POSTGRES_PASSWORD"
    "VAULT_TOKEN"
    "DATABENTO_API_KEY"
    "JWT_SECRET"
)

# Check each required credential
for CRED in "${REQUIRED_CREDS[@]}"; do
    echo -n "Checking ${CRED}... "

    # Check if credential exists
    if grep -q "^${CRED}=" "${ENV_FILE}"; then
        # Extract value
        VALUE=$(grep "^${CRED}=" "${ENV_FILE}" | cut -d'=' -f2- | tr -d '"' | tr -d "'")

        # Check if value is not empty
        if [[ -n "${VALUE}" ]]; then
            # Check if value is a placeholder
            if [[ "${VALUE}" == *"YOUR_"* ]] || [[ "${VALUE}" == *"CHANGE_THIS"* ]] || [[ "${VALUE}" == *"REPLACE"* ]]; then
                echo -e "${RED}✗${NC}"
                echo "  ERROR: ${CRED} contains placeholder value: ${VALUE}"
                ((FAILED++))
            else
                # Check minimum length (32 chars for passwords)
                LENGTH=${#VALUE}
                if [[ "${CRED}" == "POSTGRES_PASSWORD" ]] || [[ "${CRED}" == "JWT_SECRET" ]]; then
                    if [[ ${LENGTH} -lt 32 ]]; then
                        echo -e "${YELLOW}⚠${NC} (length: ${LENGTH} chars, recommended: 32+)"
                        echo "  WARNING: ${CRED} is too short (${LENGTH} chars)"
                        ((WARNINGS++))
                    else
                        echo -e "${GREEN}✓${NC} (length: ${LENGTH} chars)"
                        ((PASSED++))
                    fi
                else
                    echo -e "${GREEN}✓${NC} (length: ${LENGTH} chars)"
                    ((PASSED++))
                fi
            fi
        else
            echo -e "${RED}✗${NC}"
            echo "  ERROR: ${CRED} is empty"
            ((FAILED++))
        fi
    else
        echo -e "${RED}✗${NC}"
        echo "  ERROR: ${CRED} not found in ${ENV_FILE}"
        ((FAILED++))
    fi
done

# Check if file is gitignored
echo -n "Checking if ${ENV_FILE} is gitignored... "
if git check-ignore -q "${ENV_FILE}" 2>/dev/null; then
    echo -e "${GREEN}✓${NC}"
    ((PASSED++))
else
    echo -e "${YELLOW}⚠${NC}"
    echo "  WARNING: ${ENV_FILE} is NOT gitignored"
    echo "  This file contains secrets and should be in .gitignore"
    echo "  The pattern '.env.*' should cover this file"
    ((WARNINGS++))
fi

# Check if terraform.tfvars exists
echo -n "Checking terraform.tfvars... "
if [[ -f "terraform.tfvars" ]]; then
    echo -e "${GREEN}✓${NC}"
    ((PASSED++))

    # Check if terraform.tfvars contains deprecated credentials
    echo -n "Checking for deprecated credentials in terraform.tfvars... "
    DEPRECATED_FOUND=false
    for CRED in "${REQUIRED_CREDS[@]}"; do
        if grep -q "^${CRED}" "terraform.tfvars"; then
            DEPRECATED_FOUND=true
            break
        fi
    done

    if [[ "${DEPRECATED_FOUND}" == "true" ]]; then
        echo -e "${YELLOW}⚠${NC}"
        echo "  WARNING: Found deprecated credentials in terraform.tfvars"
        echo "  These should be removed and stored in ${ENV_FILE} instead"
        ((WARNINGS++))
    else
        echo -e "${GREEN}✓${NC}"
        ((PASSED++))
    fi
else
    echo -e "${YELLOW}⚠${NC}"
    echo "  WARNING: terraform.tfvars not found"
    echo "  Copy from: cp terraform.tfvars.example terraform.tfvars"
    ((WARNINGS++))
fi

# Print summary
echo ""
echo "========================================"
echo "Validation Summary"
echo "========================================"
echo -e "${GREEN}Passed:${NC} ${PASSED}"
echo -e "${YELLOW}Warnings:${NC} ${WARNINGS}"
echo -e "${RED}Failed:${NC} ${FAILED}"
echo ""

# Exit with appropriate code
if [[ ${FAILED} -gt 0 ]]; then
    echo -e "${RED}VALIDATION FAILED${NC}"
    echo "Fix the errors above before deploying"
    exit 1
elif [[ ${WARNINGS} -gt 0 ]]; then
    echo -e "${YELLOW}VALIDATION PASSED WITH WARNINGS${NC}"
    echo "Address warnings before production deployment"
    exit 0
else
    echo -e "${GREEN}VALIDATION PASSED${NC}"
    echo "Your credentials are properly configured!"
    echo ""
    echo "Next steps:"
    echo "  1. Deploy volume: tofu apply -target=runpod_network_volume.foxhunt_volume"
    echo "  2. Upload ${ENV_FILE} to volume as '.env'"
    echo "  3. Deploy pod: tofu apply"
    exit 0
fi