#!/bin/sh
set -eu

cd "$(dirname "$0")/.."

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM

mkdir -p "$tmp/deploy/secrets" "$tmp/deploy/workspaces"
cp compose.yaml "$tmp/compose.yaml"
cp .env.example "$tmp/.env"
printf '%s\n' 'THT_MODEL_API_KEY=example-secret' >"$tmp/deploy/secrets/thothii.secrets"
chmod 0600 "$tmp/deploy/secrets/thothii.secrets"

services=$(docker compose --project-directory "$tmp" config --services)
[ "$services" = "core
frontend" ] || {
  echo "default Compose services must be core and frontend (got: $services)" >&2
  exit 1
}

rendered=$(docker compose --project-directory "$tmp" config)
printf '%s\n' "$rendered" | grep -q 'target: thothii.secrets'
if printf '%s\n' "$rendered" | grep -Eq 'dwh_api_key|vector_reader_api_key|vector_writer_api_key|model_api_key|thoth_ca'; then
  echo "default Compose must not declare legacy per-secret mounts" >&2
  exit 1
fi
if printf '%s\n' "$rendered" | grep -Eq 'THT_[A-Z0-9_]+_SECRET_FILE:'; then
  echo "default Compose must not require legacy secret-file variables" >&2
  exit 1
fi
printf '%s\n' "$rendered" | grep -q 'THT_SECRETS_FILE: /run/secrets/thothii.secrets'

echo "default Compose contract passed."