#!/bin/sh
set -eu

require_value() {
  variable_name=$1
  eval "variable_value=\${$variable_name:-}"
  if [ -z "$variable_value" ]; then
    printf '%s\n' "${variable_name} is required for production deployment." >&2
    exit 1
  fi
}

for variable_name in \
  POSTGRES_DB \
  POSTGRES_USER \
  POSTGRES_PASSWORD \
  DATABASE_URL \
  REDIS_URL \
  SMTP_URL \
  SMTP_FROM \
  MFA_ENCRYPTION_KEY \
  PRICING_HTTP_PROVIDER_ENDPOINT
 do
  require_value "$variable_name"
done

case "$DATABASE_URL" in
  postgresql://*) ;;
  *) printf '%s\n' 'DATABASE_URL must use the postgresql:// scheme.' >&2; exit 1 ;;
esac

case "$REDIS_URL" in
  redis://*|rediss://*) ;;
  *) printf '%s\n' 'REDIS_URL must use the redis:// or rediss:// scheme.' >&2; exit 1 ;;
esac

case "$PRICING_HTTP_PROVIDER_ENDPOINT" in
  https://*) ;;
  *) printf '%s\n' 'PRICING_HTTP_PROVIDER_ENDPOINT must use HTTPS.' >&2; exit 1 ;;
esac

if [ "${PRICING_FIXTURE_PROVIDER_ENABLED:-false}" = 'true' ]; then
  printf '%s\n' 'PRICING_FIXTURE_PROVIDER_ENABLED must be false in production.' >&2
  exit 1
fi

case "$POSTGRES_PASSWORD" in
  change-me|password|secret|example*)
    printf '%s\n' 'POSTGRES_PASSWORD must not use a development placeholder.' >&2
    exit 1
    ;;
esac

printf '%s\n' 'production environment validation passed'