#!/usr/bin/env sh
# 🤖 ops validate — run every check this repo can run locally, in one command.
#
#   ./deploy/ops validate            # everything (what to run before opening a PR)
#   ./deploy/ops validate go         # Go build + vet + tests
#   ./deploy/ops validate web        # node --check on the ES modules + npm test
#   ./deploy/ops validate shell      # sh -n (+ shellcheck if present) on deploy/
#   ./deploy/ops validate infra      # tofu fmt + validate on the dev-mesh stack
#
# Why this is a verb: the checks are spread across four toolchains, and every
# one of them is easy to forget — the shell scripts and the tofu stack in
# particular have no test suite and are only ever caught by running these by
# hand. A contributor (human or agent) should not have to reconstruct the list
# from CLAUDE.md; ops is where operational knowledge lives, and "what do I run
# before pushing" is exactly that.
#
# Non-goals: this never touches a box, a credential, or the network beyond what
# `go test` and `npm test` already do (both are hermetic — httptest servers and
# Node's test runner). It is safe to run at any time, on any branch.
#
# Exit status is the number of FAILED sections (0 = all good), and every section
# runs even when an earlier one fails — one pass tells you everything that is
# broken, rather than making you re-run after each fix.
set -eu

here="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
root="$(CDPATH= cd -- "$here/.." && pwd)"
cd "$root"

bold=''; red=''; green=''; yellow=''; off=''
if [ -t 1 ]; then
  bold=$(printf '\033[1m'); red=$(printf '\033[31m'); green=$(printf '\033[32m')
  yellow=$(printf '\033[33m'); off=$(printf '\033[0m')
fi

failed=0
skipped=0

section() { printf '\n%s%s%s\n' "$bold" "$1" "$off"; }
ok()      { printf '  %sok%s    %s\n' "$green" "$off" "$1"; }
skip()    { printf '  %sskip%s  %s\n' "$yellow" "$off" "$1"; skipped=$((skipped + 1)); }
bad()     { printf '  %sFAIL%s  %s\n' "$red" "$off" "$1"; failed=$((failed + 1)); }

# run <label> <command...>: run it, show output only when it fails. Keeping a
# passing run silent is what makes the summary readable; a failure prints
# everything, because that is the moment you need it.
run() {
  label="$1"; shift
  out="$(mktemp -t lchat-validate.XXXXXX)"
  if "$@" >"$out" 2>&1; then
    ok "$label"
  else
    bad "$label"
    sed 's/^/        /' "$out"
  fi
  rm -f "$out"
}

validate_go() {
  section "Go"
  if ! command -v go >/dev/null 2>&1; then skip "go not installed"; return; fi
  run "build (all packages)" go build ./...
  # vet is advisory here: the tree carries a pre-existing finding in
  # checkpoint_test.go, so a failure must not mask a real regression elsewhere.
  # Shown, not counted.
  if go vet ./... >/dev/null 2>&1; then
    ok "vet"
  else
    printf '  %swarn%s  vet reported findings:\n' "$yellow" "$off"
    go vet ./... 2>&1 | sed 's/^/        /' || true
  fi
  run "tests" go test ./...
}

validate_web() {
  section "Web"
  if command -v node >/dev/null 2>&1; then
    # The ES modules are never executed by the test suite, so a syntax error
    # ships silently — `node --check` is the only thing standing in the way.
    bad_files=''
    for f in web/static/*.js web/static/apps/*.js; do
      [ -f "$f" ] || continue
      node --check "$f" >/dev/null 2>&1 || bad_files="$bad_files $f"
    done
    if [ -n "$bad_files" ]; then
      bad "node --check —$bad_files"
      for f in $bad_files; do node --check "$f" 2>&1 | sed 's/^/        /' || true; done
    else
      ok "node --check (every web/static ES module parses)"
    fi
  else
    skip "node not installed"
  fi
  if [ -f package.json ] && command -v npm >/dev/null 2>&1; then
    run "npm test (crypto, ui, format, event vectors)" npm test --silent
  else
    skip "npm test (no npm or package.json)"
  fi
}

validate_shell() {
  section "Shell"
  # These scripts have no test suite, so a parse check is the floor. deploy/
  # deliberately mixes sh and bash (ops and its verbs are POSIX sh; the
  # collectors are bash and use arrays and `local`), so each file is checked
  # with the interpreter its OWN shebang names — forcing `sh -n` on a bash
  # script reports syntax errors that are not there.
  bad_files=''
  for f in "$here"/ops "$here"/*.sh; do
    [ -f "$f" ] || continue
    case "$(head -1 "$f")" in
      *bash) shell='bash' ;;
      *) shell='sh' ;;
    esac
    "$shell" -n "$f" >/dev/null 2>&1 || bad_files="$bad_files $(basename "$f")"
  done
  if [ -n "$bad_files" ]; then
    bad "parse —$bad_files"
    for f in $bad_files; do
      case "$(head -1 "$here/$f")" in *bash) shell='bash' ;; *) shell='sh' ;; esac
      "$shell" -n "$here/$f" 2>&1 | sed 's/^/        /' || true
    done
  else
    ok "parse (every deploy/ script, per its own shebang)"
  fi

  if command -v shellcheck >/dev/null 2>&1; then
    # Advisory, and shebang-driven (no -s override, same reason as above). The
    # tree carries known pre-existing findings (SC1007/SC1091/SC2016), so
    # counting them would make this verb useless on day one: it reports and
    # never fails. Read it when you touch a script.
    if shellcheck "$here"/ops "$here"/*.sh >/dev/null 2>&1; then
      ok "shellcheck"
    else
      printf '  %swarn%s  shellcheck findings (advisory — pre-existing ones exist):\n' "$yellow" "$off"
      shellcheck "$here"/ops "$here"/*.sh 2>&1 | grep -E '^In ' | sed "s|$root/||" | head -30 | sed 's/^/        /' || true
    fi
  else
    skip "shellcheck not installed (brew install shellcheck)"
  fi
}

validate_infra() {
  section "Infra (dev-mesh tofu)"
  stack="$root/infra/dev-mesh"
  if [ ! -d "$stack" ]; then skip "no infra/dev-mesh"; return; fi
  if ! command -v tofu >/dev/null 2>&1; then skip "tofu not installed"; return; fi
  # fmt + validate only: both are offline and read-only. `plan` needs AWS
  # credentials and talks to the provider, so it stays in `ops dev plan` where
  # the credential handling lives — validate must never need a secret.
  run "tofu fmt" tofu -chdir="$stack" fmt -check -diff
  if [ -d "$stack/.terraform" ]; then
    run "tofu validate" tofu -chdir="$stack" validate
  else
    skip "tofu validate (not initialised — run: ops dev plan)"
  fi
}

what="${1:-all}"
case "$what" in
  all)    validate_go; validate_web; validate_shell; validate_infra ;;
  go)     validate_go ;;
  web)    validate_web ;;
  shell)  validate_shell ;;
  infra)  validate_infra ;;
  -h|--help|help)
    sed -n '2,8p' "$0" | sed 's/^# \{0,1\}//'
    exit 0 ;;
  *)
    echo "ops validate: unknown section '$what' (all|go|web|shell|infra)" >&2
    exit 2 ;;
esac

printf '\n'
if [ "$failed" -eq 0 ]; then
  printf '%s%s%s' "$green" "all checks passed" "$off"
  [ "$skipped" -gt 0 ] && printf ' (%d skipped)' "$skipped"
  printf '\n'
  exit 0
fi
printf '%s%d section(s) FAILED%s\n' "$red" "$failed" "$off"
exit "$failed"