#!/usr/bin/env bash
set -euo pipefail

repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
test_dir=$(mktemp -d)
trap 'rm -rf -- "$test_dir"' EXIT

install -d "$test_dir/env" "$test_dir/.komodo"
cp -- "$repo_root/docker-compose.yml" "$test_dir/docker-compose.yml"
cp -- "$repo_root/docker-compose.override.yml" "$test_dir/docker-compose.override.yml"
cp -- "$repo_root/env/common.env" "$test_dir/env/common.env"

cat > "$test_dir/.komodo/prod.env" <<'EOF'
PG_PASS=SENTINEL_POSTGRES_PASSWORD
AUTHENTIK_SECRET_KEY=SENTINEL_AUTHENTIK_SECRET_KEY
AUTHENTIK_EMAIL__PASSWORD=SENTINEL_EMAIL_PASSWORD
GEOIPUPDATE_LICENSE_KEY=SENTINEL_GEOIP_LICENSE_KEY
EOF

(
	cd "$test_dir"
	docker compose \
		--env-file env/common.env \
		--env-file .komodo/prod.env \
		--file docker-compose.yml \
		--file docker-compose.override.yml \
		config --format json
) > "$test_dir/rendered.json"

if grep -F 'SENTINEL_' "$test_dir/rendered.json"; then
	printf 'Rendered Compose configuration contains plaintext secrets\n' >&2
	exit 1
fi

jq -e '
	.services.postgresql.environment.POSTGRES_PASSWORD_FILE == "/run/secrets/postgres_password" and
	(.services.postgresql.environment | has("POSTGRES_PASSWORD") | not) and
	.services.server.environment.AUTHENTIK_POSTGRESQL__PASSWORD == "file:///run/secrets/postgres_password" and
	.services.server.environment.AUTHENTIK_SECRET_KEY == "file:///run/secrets/authentik_secret_key" and
	.services.server.environment.AUTHENTIK_EMAIL__PASSWORD == "file:///run/secrets/authentik_email_password" and
	.services.geoipupdate.environment.GEOIPUPDATE_LICENSE_KEY_FILE == "/run/secrets/geoip_license_key" and
	([.services.postgresql.secrets[].source] | sort) == ["postgres_password"] and
	([.services.server.secrets[].source] | sort) == ["authentik_email_password", "authentik_secret_key", "postgres_password"] and
	([.services.worker.secrets[].source] | sort) == ["authentik_email_password", "authentik_secret_key", "postgres_password"] and
	([.services.geoipupdate.secrets[].source] | sort) == ["geoip_license_key"] and
	(.services.redis | has("secrets") | not)
' "$test_dir/rendered.json" >/dev/null