#!/bin/sh
set -eu

root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
cd "$root"

sh -n install.sh
sh -n s-migrate.sh

if rg -n 'git[[:space:]]+clone|OverCooked-S\.git|Overcooked-E\.git|Authorization:[[:space:]]*Bearer' . --glob '!.git/**'; then
  echo 'forbidden source checkout or authorization header found' >&2
  exit 1
fi

test -f compose/s.yml
test -f compose/e.yml
test -f config/e-server.production.yaml
test -f s-migrations.tar.gz
test "$(tar -tzf s-migrations.tar.gz | awk '/\.up\.sql$/ { count++ } END { print count + 0 }')" -gt 0
test -x test/database-credentials.sh
sha256sum -c SHA256SUMS >/dev/null
! rg -n '^([[:space:]]*)build:' compose
! rg -n 'overcooked-auth|overcooked-auth-webui' compose install.sh
! rg -n 'S_TURNSTILE_(SITE|SECRET)_KEY: .*\\?required' compose
! rg -n 'S_INTERNAL_TLS_(ADDR|CERT_FILE|KEY_FILE|CLIENT_CA_FILE)' compose install.sh
! rg -n 'psql[[:space:]]+-U[[:space:]]+postgres|(^|[^[:alnum:]_])eval([[:space:]]|$)' install.sh
rg -n 'psql[[:space:]]+-U[[:space:]]+product_e|psql[[:space:]]+-U[[:space:]]+product_s' install.sh >/dev/null
rg -n 'control-proxy|PRODUCT_E_CONTROL_PLANE_TLS_' compose install.sh >/dev/null
./test/database-credentials.sh
echo 'static customer installer checks passed'