#!/usr/bin/env bash

set -Eeuo pipefail

readonly ROOT="$(cd -- "$(dirname -- "$BASH_SOURCE")/../.." && pwd -P)"
readonly DENY="$ROOT/infrastructure/networking/host-nginx/learn-services-grafana-deny-guard.conf"
readonly FULL="$ROOT/infrastructure/networking/host-nginx/learn-services-observability.conf"

fail() {
  printf 'FAIL: %s\n' "$*" >&2
  exit 1
}

[[ -f "$DENY" && ! -L "$DENY" ]] || fail 'deny-guard source is missing'
[[ -f "$FULL" && ! -L "$FULL" ]] || fail 'full observability source is missing'

python3 - "$DENY" "$FULL" <<'PY'
import pathlib
import sys

deny_path, full_path = map(pathlib.Path, sys.argv[1:])
deny = deny_path.read_text()
full = full_path.read_text()
old = "        proxy_pass http://127.0.0.1:1;"
new = "        proxy_pass http://127.0.0.1:30080;"

if deny.count(old) != 1:
    raise SystemExit("FAIL: deny guard does not have one closed Grafana upstream")
if deny.count(new) != 4:
    raise SystemExit("FAIL: deny guard existing service upstream set changed")
expected = deny.replace(old, new, 1)
if full != expected:
    raise SystemExit("FAIL: full candidate differs from deny guard outside the Grafana upstream")
if full.count(old) != 0 or full.count(new) != 5:
    raise SystemExit("FAIL: full candidate Grafana upstream is not exact")

required = (
    "ssl_reject_handshake on;",
    "server_name git.learn.hyeonworks.com;",
    "server_name id.learn.hyeonworks.com;",
    "server_name storage-admin.learn.hyeonworks.com;",
    "server_name db-admin.learn.hyeonworks.com;",
    "server_name grafana.learn.hyeonworks.com;",
    "location = /metrics {",
    "allow 192.168.0.0/24;",
    "allow 100.64.0.0/10;",
    "deny all;",
)
for token in required:
    if token not in full:
        raise SystemExit(f"FAIL: full candidate lacks {token}")
if full.count("location = /metrics {") != 2:
    raise SystemExit("FAIL: Gitea and Grafana metrics guards are not exact")
PY

printf 'HOST NGINX OBSERVABILITY SOURCE CONTRACT PASS\n'