#!/usr/bin/env bash
# check_secrets.sh - Validate environment variables without exposing values
# Exit code: 0 = all OK, 1 = missing or invalid

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
ENV_FILE="$PROJECT_ROOT/.env"

FAILED=0

check_var() {
    local var_name="$1"
    local required="${2:-true}"
    local min_length="${3:-0}"
    
    if [ ! -f "$ENV_FILE" ]; then
        echo "✗ FAIL: .env file not found"
        exit 1
    fi
    
    # Get value without echoing it
    local value
    value=$(grep -E "^${var_name}=" "$ENV_FILE" 2>/dev/null | cut -d'=' -f2-)
    
    if [ -z "$value" ]; then
        if [ "$required" = "true" ]; then
            echo "✗ FAIL: $var_name is MISSING"
            FAILED=$((FAILED + 1))
        else
            echo "⚠ WARN: $var_name is not set (optional)"
        fi
        return
    fi
    
    # Check minimum length
    if [ ${#value} -lt "$min_length" ]; then
        echo "✗ FAIL: $var_name is too short (min $min_length chars)"
        FAILED=$((FAILED + 1))
        return
    fi
    
    # Check for placeholder values
    if [[ "$value" == *"your_"* ]] || [[ "$value" == *"CHANGE_ME"* ]] || [[ "$value" == *"sk-cb26-local"* ]]; then
        if [ "$required" = "true" ]; then
            echo "⚠ WARN: $var_name looks like a placeholder value"
        else
            echo "ℹ INFO: $var_name has placeholder value"
        fi
        return
    fi
    
    echo "✓ PASS: $var_name present (${#value} chars)"
}

echo "=== CyberBrain26 Secret Validation ==="
echo "File: $ENV_FILE"
echo "Date: $(date -Iseconds)"
echo ""

echo "--- Required variables ---"
check_var "CB26_PROJECT_ROOT" true 5
check_var "CB26_DB_PATH" true 5
check_var "CB26_PROXY_URL" true 10
check_var "CB26_PROXY_KEY" true 10

echo ""
echo "--- Optional variables ---"
check_var "CB26_WEB_PORT" false 0
check_var "CB26_TTYD_URL" false 0
check_var "CB26_ONION_SEARCH" false 0
check_var "CB26_MEMORY_CONVERSATIONS" false 0
check_var "CB26_LOG_LEVEL" false 0

echo ""
echo "--- Provider keys (optional but recommended) ---"
check_var "GEMINI_API_KEY" false 20
check_var "GROQ_API_KEY" false 20
check_var "MISTRAL_API_KEY" false 20
check_var "OPENROUTER_API_KEY" false 20

echo ""
echo "--- Security warnings ---"

# Check if .env is in git
cd "$PROJECT_ROOT"
if git ls-files --error-unmatch .env >/dev/null 2>&1; then
    echo "✗ CRITICAL: .env is tracked in Git! Remove it immediately:"
    echo "  git rm --cached .env"
    echo "  echo '.env' >> .gitignore"
    FAILED=$((FAILED + 1))
else
    echo "✓ PASS: .env is not tracked in Git"
fi

# Check .gitignore
if grep -q "^\.env$" "$PROJECT_ROOT/.gitignore" 2>/dev/null; then
    echo "✓ PASS: .env is in .gitignore"
else
    echo "⚠ WARN: .env is not in .gitignore"
fi

echo ""
echo "=== Summary ==="
if [ "$FAILED" -gt 0 ]; then
    echo "FAILED: $FAILED check(s) failed"
    exit 1
else
    echo "All secret checks passed."
    exit 0
fi