#!/usr/bin/env bash
# Stage 1 overlay render: contract + helm template of every independently
# rollable values file. Does not contact the cluster.
set -euo pipefail
cd "$(dirname "${BASH_SOURCE[0]}")/.."

python3 tests/validate_app_toml.py

for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
              values/user-engine.yaml values/tenant-engine.yaml values/ops-warden.yaml; do
  echo "helm template ${values}"
  helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
done

user_render="$(helm template flex-auth-user-engine charts/flex-auth -f values/user-engine.yaml --namespace flex-auth)"
echo "$user_render" | grep -q -- '--caller-auth-mode' || { echo "user-engine render omits caller-auth-mode" >&2; exit 1; }
echo "$user_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
  || { echo "user-engine caller-auth-mode must be warn or enforce" >&2; exit 1; }
echo "$user_render" | grep -q tokenreviews || { echo "user-engine render omits TokenReview RBAC" >&2; exit 1; }
echo "$user_render" | grep -q flex-auth-reviewer || { echo "user-engine render omits reviewer projection" >&2; exit 1; }

tenant_render="$(helm template flex-auth-tenant-engine charts/flex-auth -f values/tenant-engine.yaml --namespace flex-auth)"
echo "$tenant_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
  || { echo "tenant-engine caller-auth-mode must be warn or enforce" >&2; exit 1; }
echo "$tenant_render" | grep -q 'tenant-engine=system:serviceaccount:tenant-engine:tenant-engine' \
  || { echo "tenant-engine render omits its exact binding" >&2; exit 1; }

ops_render="$(helm template flex-auth-ops-warden charts/flex-auth -f values/ops-warden.yaml --namespace flex-auth)"
echo "$ops_render" | grep -A1 -- '--caller-auth-mode' | grep -Eq 'warn|enforce' \
  || { echo "ops-warden caller-auth-mode must be warn or enforce" >&2; exit 1; }
echo "$ops_render" | grep -q 'ops-warden=system:serviceaccount:ops-warden:ops-warden' \
  || { echo "ops-warden render omits its exact binding" >&2; exit 1; }
echo "$ops_render" | grep -q production_registry_snapshot.json \
  || { echo "ops-warden render omits the production registry" >&2; exit 1; }

# The fetch pin's digest stays empty until CI builds an image containing
# examples/ops-warden-fetch; render it with a placeholder until then.
fetch_digest_args=()
if grep -Eq '^\s*digest:\s*(""|)\s*$' values/ops-warden-fetch.yaml; then
  echo "note: values/ops-warden-fetch.yaml has no image digest yet (not deployable); rendering with a placeholder"
  fetch_digest_args=(--set image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000)
fi
echo "helm template values/ops-warden-fetch.yaml"
fetch_render="$(helm template flex-auth-ops-warden-fetch charts/flex-auth -f values/ops-warden-fetch.yaml "${fetch_digest_args[@]}" --namespace flex-auth)"
echo "$fetch_render" | grep -A1 -- '--caller-auth-mode' | grep -q enforce \
  || { echo "ops-warden-fetch caller-auth-mode must be enforce" >&2; exit 1; }
for system in railiance-platform key-cape; do
  echo "$fetch_render" | grep -q "${system}=system:serviceaccount:ops-warden:ops-warden" \
    || { echo "ops-warden-fetch render omits the ${system} binding" >&2; exit 1; }
done
echo "$fetch_render" | grep -q examples/ops-warden-fetch/policy_package.md \
  || { echo "ops-warden-fetch render omits its policy package" >&2; exit 1; }
python3 tools/gen_ops_warden_fetch.py --check >/dev/null 2>&1 || [ ! -f "${HOME}/ops-warden/registry/routing/catalog.yaml" ] \
  || { echo "ops-warden-fetch is out of date with the routing catalog; run tools/gen_ops_warden_fetch.py" >&2; exit 1; }

if [ -f "${HOME}/informed-decision/deploy/intake-submitters.json" ]; then
  python3 tools/gen_informed_decision_admission.py --check >/dev/null \
    || { echo "informed-decision attribute admission sets drifted; run tools/gen_informed_decision_admission.py" >&2; exit 1; }
fi

canary_render="$(helm template flex-auth-canary charts/flex-auth -f values/stage2-canary.yaml --namespace flex-auth)"
if echo "$canary_render" | grep -q tokenreviews; then
  echo "isolated canary must not create TokenReview RBAC" >&2
  exit 1
fi

echo "stage1 overlay render ok"