#!/usr/bin/env sh
set -eu

realm="${KEYCLOAK_REALM:-keycloak-patterns}"
public_keycloak_url="${PUBLIC_KEYCLOAK_URL:-https://auth.example.test}"
expected="$public_keycloak_url/realms/$realm/broker/google/endpoint"

case "$public_keycloak_url" in
  https://*) ;;
  *)
    echo "PUBLIC_KEYCLOAK_URL must use https outside the local mock environment" >&2
    exit 1
    ;;
esac

case "$public_keycloak_url" in
  *\** | */)
    echo "PUBLIC_KEYCLOAK_URL must be an exact origin without wildcard/trailing slash" >&2
    exit 1
    ;;
esac

test "$expected" = "https://auth.example.test/realms/keycloak-patterns/broker/google/endpoint"
echo "Google redirect URI policy verified: $expected"