#!/bin/sh
set -eu

cd "$(dirname "$0")/.."
project="thothii-external-lifecycle-$$"
cleanup() { docker compose --project-name "$project" --profile external down --volumes >/dev/null 2>&1 || true; }
trap cleanup EXIT HUP INT TERM

export THT_WORKSPACE_GIT_REMOTE=https://git.example.invalid/platform/thoth-workspaces.git
export PI_AUTH_FILE=/dev/null

unset THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE
unset THT_VECTOR_READER_PASSWORD_SECRET_FILE THT_VECTOR_WRITER_PASSWORD_SECRET_FILE
rendered=$(docker compose --project-name "$project" --profile external config)
if printf '%s' "$rendered" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|vector_.*password'; then
  echo "external config contains local vector secret references" >&2
  exit 1
fi
if printf '%s' "$rendered" | grep -Eqi 'omics_portal|chirone|localllm_default|/home/chirone|datamart-builder'; then
  echo "external config contains deployment-specific coupling" >&2
  exit 1
fi
docker compose --project-name "$project" --profile external up --build --wait core
core=$(docker compose --project-name "$project" --profile external ps -q core)
inspect=$(docker inspect "$core")
if printf '%s' "$inspect" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|/run/secrets/vector_.*password'; then
  echo "external core inspect contains local vector secret references" >&2
  exit 1
fi
if printf '%s' "$inspect" | grep -Eqi 'omics_portal|chirone|localllm_default|/home/chirone|datamart-builder'; then
  echo "external core inspect contains deployment-specific coupling" >&2
  exit 1
fi
echo "external core lifecycle without local vector secrets passed."