#!/usr/bin/env bash
# Static safety checks for the deployable EG334S CloudFormation templates.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
templates=(
  "$ROOT/docs/iac/vpn1-onprem-us-east-1.yaml"
  "$ROOT/docs/iac/vpn1-awspublic-eu-west-1.yaml"
)

for template in "${templates[@]}"; do
  if grep -Eq '^[[:space:]]*Default:[[:space:]]*0\.0\.0\.0/0' "$template"; then
    echo "FAIL: permissive parameter default in $template" >&2
    exit 1
  fi
  if ! grep -Eq "AllowedPattern:.*\/32" "$template"; then
    echo "FAIL: AdminCidr is not constrained to /32 in $template" >&2
    exit 1
  fi
done

echo "PASS: CloudFormation administrator CIDRs are explicit /32 values."

azure_template="$ROOT/docs/iac/eg334s-azure-cell.bicep"
if grep -Eq "param adminSourceCidr string[[:space:]]*=[[:space:]]*['\"]\\*['\"]" "$azure_template"; then
  echo "FAIL: Azure administrator source has a permissive default" >&2
  exit 1
fi
if ! grep -q "@secure()" "$azure_template" ||
   ! grep -q 'param vpnSharedKey string' "$azure_template"; then
  echo "FAIL: VPN2 pre-shared key is not a secure Azure parameter" >&2
  exit 1
fi
echo "PASS: Azure SSH source is explicit and VPN pre-shared keys are secure parameters."

azure_vpn_template="$ROOT/docs/iac/azure-vpn2.bicep"
if grep -Eq "Microsoft\\.(Compute/virtualMachines|Network/networkInterfaces|Network/virtualNetworks)@.*' = \\{" "$azure_vpn_template"; then
  echo "FAIL: scoped Azure VPN deployment must not update core VM, NIC or VNet resources" >&2
  exit 1
fi
if ! grep -q 'existing = {' "$azure_vpn_template" ||
   ! grep -q 'param vpn2SharedKey string' "$azure_vpn_template"; then
  echo "FAIL: scoped Azure VPN deployment does not safely import the core network or secure VPN2" >&2
  exit 1
fi
echo "PASS: live Azure VPN deployment is scoped away from core VM, NIC and VNet resources."

recovery_template="$ROOT/docs/iac/hub-recovery-eu-west-1.yaml"
if grep -Eq 'AWS::EC2::VPN|AWS::EC2::CustomerGateway|AWS::EC2::VPCGatewayAttachment' "$recovery_template"; then
  echo "FAIL: hub recovery stack must not create or replace VPN/VGW resources" >&2
  exit 1
fi
if ! grep -Eq "MinSize:[[:space:]]*'1'" "$recovery_template" ||
   ! grep -Eq "DesiredCapacity:[[:space:]]*'1'" "$recovery_template" ||
   ! grep -Eq "MaxSize:[[:space:]]*'1'" "$recovery_template"; then
  echo "FAIL: Ireland secondary stack does not encode the active-active 1/1/1 baseline" >&2
  exit 1
fi
if ! grep -q 'Threshold: 600' "$recovery_template"; then
  echo "FAIL: accepted 10-minute recovery objective is not encoded" >&2
  exit 1
fi
if grep -q 'Type: AWS::EC2::Subnet' "$recovery_template" ||
   ! grep -q 'RecoverySubnetId' "$recovery_template"; then
  echo "FAIL: recovery must import, not own, the ALB second-AZ subnet." >&2
  exit 1
fi

echo "PASS: Ireland secondary is isolated from VPN resources, active at 1/1/1, and monitored at 600 seconds."

alb_template="$ROOT/docs/iac/hub-alb-eu-west-1.yaml"
if grep -Eqi 'personal|eg334s-personal-targets' "$alb_template"; then
  echo "FAIL: ALB template contains personal-account naming or identifiers." >&2
  exit 1
fi
if ! grep -q 'SecondaryPublicSubnet:' "$alb_template" ||
   ! grep -q 'SecondaryPublicSubnetId:' "$alb_template"; then
  echo "FAIL: ALB template does not own and export the required second-AZ subnet." >&2
  exit 1
fi
echo "PASS: ALB template is account-neutral and supplies the second-AZ subnet."

if grep -R -Eq 'arn:aws:iam::[0-9]{12}|vpc-[0-9a-f]{8,}|subnet-[0-9a-f]{8,}|sg-[0-9a-f]{8,}|i-[0-9a-f]{8,}' \
  "$ROOT/docs/iac/"*.yaml "$ROOT/docs/iac/"*.bicep; then
  echo "FAIL: deployable IaC contains an account-specific AWS identifier." >&2
  exit 1
fi
echo "PASS: deployable IaC contains no account-specific AWS resource identifiers."

school_helper="$ROOT/scripts/school-deploy.sh"
school_env="$ROOT/docs/iac/school-account.env.example"
if ! grep -q 'EG334S_EXPECTED_ACCOUNT_ID' "$school_helper" ||
   ! grep -q 'EG334S_EXECUTE.*DEPLOY' "$school_helper"; then
  echo "FAIL: school deployment helper is missing account or write gates." >&2
  exit 1
fi
if grep -Eq 'AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|(^|[^0-9])[0-9]{12}([^0-9]|$)' \
  "$school_env"; then
  echo "FAIL: school environment example contains a credential or real account ID." >&2
  exit 1
fi
echo "PASS: school helper requires an exact account match and explicit write gate."