#!/usr/bin/env bash
# Audit required and optional credentials across workspace dotenv files.
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

ok() { echo -e "${GREEN}✅${NC} $1"; }
warn() { echo -e "${YELLOW}⚠️${NC}  $1"; }
fail() { echo -e "${RED}❌${NC} $1"; }

is_placeholder() {
  local v="$1"
  [[ -z "$v" ]] && return 0
  [[ "$v" == *replace_me* ]] && return 0
  [[ "$v" == *your_* ]] && return 0
  [[ "$v" == *temp_* ]] && return 0
  return 1
}

read_env() {
  local file="$1"
  local key="$2"
  [[ -f "$file" ]] || { echo ""; return; }
  grep -E "^${key}=" "$file" 2>/dev/null | head -1 | cut -d= -f2- | sed 's/^"//;s/"$//' || true
}

echo "=== Solace Treasury — Environment Audit ==="
echo ""

# Frontend
FE="$ROOT/frontend/.env.local"
echo "## Frontend ($FE)"
for key in NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID NEXT_PUBLIC_CHAIN138_RPC_URL NEXT_PUBLIC_TREASURY_WALLET_ADDRESS NEXT_PUBLIC_SUB_ACCOUNT_FACTORY_ADDRESS NEXT_PUBLIC_API_URL; do
  val=$(read_env "$FE" "$key")
  if is_placeholder "$val"; then
    if [[ "$key" == "NEXT_PUBLIC_WALLETCONNECT_PROJECT_ID" ]]; then
      warn "$key optional (Injected/MetaMask work without it)"
    else
      fail "$key missing or placeholder"
    fi
  else
    ok "$key set"
  fi
done

# Backend
BE="$ROOT/backend/.env"
echo ""
echo "## Backend ($BE)"
for key in DATABASE_URL RPC_URL CHAIN_ID CONTRACT_ADDRESS FACTORY_ADDRESS; do
  val=$(read_env "$BE" "$key")
  if is_placeholder "$val"; then
    fail "$key missing or placeholder"
  else
    ok "$key set"
  fi
done

IDX="$ROOT/backend/.env.indexer"
echo ""
echo "## Indexer ($IDX)"
if [[ -f "$IDX" ]]; then
  for key in CONTRACT_ADDRESS START_BLOCK RPC_URL; do
    val=$(read_env "$IDX" "$key")
    if is_placeholder "$val"; then
      warn "$key missing in .env.indexer (falls back to backend/.env)"
    else
      ok "$key set"
    fi
  done
else
  warn ".env.indexer not found"
fi

# Contracts
CE="$ROOT/contracts/.env"
echo ""
echo "## Contracts ($CE)"
for key in CHAIN138_RPC_URL PRIVATE_KEY; do
  val=$(read_env "$CE" "$key")
  if is_placeholder "$val"; then
    fail "$key missing or placeholder"
  else
    ok "$key set"
  fi
done

# Address alignment
DEPLOY="$ROOT/contracts/deployments/chain138.json"
if [[ -f "$DEPLOY" && -f "$BE" ]]; then
  echo ""
  echo "## Deployment alignment"
  DEPLOY_TREASURY=$(jq -r '.contracts.TreasuryWallet' "$DEPLOY" | tr '[:upper:]' '[:lower:]')
  ENV_TREASURY=$(read_env "$BE" CONTRACT_ADDRESS | tr '[:upper:]' '[:lower:]')
  if [[ -n "$DEPLOY_TREASURY" && "$DEPLOY_TREASURY" == "$ENV_TREASURY" ]]; then
    ok "CONTRACT_ADDRESS matches chain138.json"
  else
    warn "CONTRACT_ADDRESS drift — run ./scripts/sync-env-from-deployment.sh"
  fi
fi

# Connectivity
echo ""
echo "## Connectivity"
RPC=$(read_env "$BE" RPC_URL)
RPC="${RPC:-http://192.168.11.211:8545}"
if curl -sf -m 3 -X POST "$RPC" -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' | grep -q '"0x8a"'; then
  ok "Chain 138 RPC reachable ($RPC)"
else
  fail "Chain 138 RPC unreachable ($RPC)"
fi

DB=$(read_env "$BE" DATABASE_URL)
if [[ -n "$DB" ]]; then
  if command -v psql >/dev/null && psql "$DB" -c "SELECT 1;" >/dev/null 2>&1; then
    ok "PostgreSQL reachable"
  else
    warn "PostgreSQL not reachable (use local Docker or Proxmox CT 3002)"
  fi
fi

API=$(read_env "$FE" NEXT_PUBLIC_API_URL)
API="${API:-http://localhost:3001}"
if curl -sf -m 3 "$API/health" | grep -q '"status"'; then
  ok "Backend API reachable ($API)"
else
  warn "Backend API not reachable ($API) — run pnpm run dev"
fi

if [[ -f "$DEPLOY" ]]; then
  ok "Chain138 deployment record present"
else
  warn "No contracts/deployments/chain138.json — run deploy:chain138"
fi

echo ""
echo "Run ./scripts/sync-env-from-deployment.sh after deploy to propagate addresses."