#!/usr/bin/env bash
set -euo pipefail

# ──────────────────────────────────────────────
# Environment variable validation script
# ──────────────────────────────────────────────

ERRORS=0
LOG_PREFIX="[env-check]"

log() {
  echo "$(date '+%Y-%m-%d %H:%M:%S') $LOG_PREFIX $1"
}

check_var() {
  local var_name="$1"
  local var_value="${!var_name:-}"

  if [ -z "$var_value" ]; then
    log "MISSING: $var_name is not set"
    ERRORS=$((ERRORS + 1))
    return 1
  fi
  return 0
}

check_var_format() {
  local var_name="$1"
  local pattern="$2"
  local description="$3"
  local var_value="${!var_name:-}"

  if [ -z "$var_value" ]; then
    return 0  # Already caught by check_var
  fi

  if ! echo "$var_value" | grep -qE "$pattern"; then
    log "INVALID: $var_name - $description (got: ${var_value:0:20}...)"
    ERRORS=$((ERRORS + 1))
    return 1
  fi
  return 0
}

log "Validating environment variables..."
echo ""

# ── Required variables ──
log "Checking required variables..."

check_var "NODE_ENV"
check_var "DATABASE_URL"
check_var "REDIS_HOST"
check_var "REDIS_PORT"
check_var "REDIS_PASSWORD"
check_var "BETTER_AUTH_SECRET"
check_var "BETTER_AUTH_URL"
check_var "MINIO_ENDPOINT"
check_var "MINIO_ACCESS_KEY"
check_var "MINIO_SECRET_KEY"
check_var "MINIO_BUCKET_NAME"
check_var "MINIO_PUBLIC_URL"
check_var "CORS_ORIGIN"

echo ""

# ── Format validation ──
log "Validating variable formats..."

check_var_format "DATABASE_URL" "^postgres(ql)?://" \
  "must start with postgres:// or postgresql://"

check_var_format "BETTER_AUTH_URL" "^https?://" \
  "must be a valid URL starting with http:// or https://"

check_var_format "MINIO_PUBLIC_URL" "^https?://" \
  "must be a valid URL starting with http:// or https://"

check_var_format "CORS_ORIGIN" "^https?://" \
  "must be a valid URL starting with http:// or https://"

check_var_format "REDIS_PORT" "^[0-9]+$" \
  "must be a numeric port number"

check_var_format "NODE_ENV" "^(development|production|test)$" \
  "must be one of: development, production, test"

if [ -n "${BETTER_AUTH_SECRET:-}" ]; then
  if [ ${#BETTER_AUTH_SECRET} -lt 32 ]; then
    log "INVALID: BETTER_AUTH_SECRET must be at least 32 characters (got: ${#BETTER_AUTH_SECRET})"
    ERRORS=$((ERRORS + 1))
  fi
fi

echo ""

# ── Optional variables (warn if missing) ──
log "Checking optional variables (warnings only)..."

for var in PL24_API_URL PL24_USERNAME PL24_PASSWORD \
           EMEX_USERNAME EMEX_PASSWORD; do
  if [ -z "${!var:-}" ]; then
    log "WARNING: $var is not set (optional)"
  fi
done

echo ""

# ── Summary ──
if [ $ERRORS -gt 0 ]; then
  log "FAILED: $ERRORS error(s) found. Fix the issues above and try again."
  exit 1
else
  log "PASSED: All required environment variables are valid."
  exit 0
fi