#!/usr/bin/env bash
set -euo pipefail

ENV_FILE="${1:?Usage: $0 <env-file>}"

if [[ ! -f "$ENV_FILE" ]]; then
  echo "Environment file not found: $ENV_FILE" >&2
  exit 1
fi

set -a
# shellcheck disable=SC1090
source "$ENV_FILE"
set +a

DJANGO_ENV="${DJANGO_ENV:-prod}"

required_vars=(
  DJANGO_SECRET_KEY
  DJANGO_ALLOWED_HOSTS
  DATABASE_URL
  WEB_PORT
  OLLAMA_BASE_URL
)

if [[ "$DJANGO_ENV" == "prod" || "$DJANGO_ENV" == "beta" ]]; then
  required_vars+=(
    EMAIL_HOST_USER
    EMAIL_HOST_PASSWORD
  )
fi

missing=()
for var in "${required_vars[@]}"; do
  if [[ -z "${!var:-}" ]]; then
    missing+=("$var")
  fi
done

if ((${#missing[@]} > 0)); then
  echo "Missing required environment variables in $ENV_FILE:" >&2
  printf '  - %s\n' "${missing[@]}" >&2
  echo "Copy .env.prod.example to ~/Documents/secrets/chat_backend/chat_backend_${DJANGO_ENV}.env and set production values." >&2
  exit 1
fi

if [[ "$DJANGO_ENV" == "prod" || "$DJANGO_ENV" == "beta" ]]; then
  if [[ "$DJANGO_SECRET_KEY" == change-me* || "$DJANGO_SECRET_KEY" == *dev-only* || "$DJANGO_SECRET_KEY" == django-insecure* ]]; then
    echo "DJANGO_SECRET_KEY must be a real secret for $DJANGO_ENV (not an example/dev value)." >&2
    exit 1
  fi
fi

echo "Environment validation passed (DJANGO_ENV=$DJANGO_ENV)."