#!/usr/bin/env bash

set -Eeuo pipefail

readonly REPO_DIR="$(
    cd "$(dirname "${BASH_SOURCE[0]}")/.."
    pwd
)"

status=0

fail() {
    printf '[!] %s\n' "$*" >&2
    status=1
}

echo '[*] Validation syntaxique Bash'

while IFS= read -r -d '' file; do
    bash -n "$file" || status=1
done < <(
    find \
        "$REPO_DIR/scripts" \
        "$REPO_DIR/rootfs/usr/local/sbin" \
        -type f \
        -print0 2>/dev/null
)

echo '[*] Validation des listes de paquets'

for file in \
    "$REPO_DIR/pkglist/pacman.txt" \
    "$REPO_DIR/pkglist/aur.txt" \
    "$REPO_DIR/pkglist/orphans.txt"
do
    [[ -f "$file" ]] || {
        fail "Liste absente : $file"
        continue
    }

    LC_ALL=C sort -cu "$file" ||
        fail "Liste non triée ou contenant des doublons : $file"
done

if [[ -f "$REPO_DIR/pkglist/pacman.txt" &&
      -f "$REPO_DIR/pkglist/aur.txt" ]]; then
    if LC_ALL=C comm -12 \
        "$REPO_DIR/pkglist/pacman.txt" \
        "$REPO_DIR/pkglist/aur.txt" |
        grep -q .
    then
        fail 'Des paquets apparaissent dans les listes Pacman et AUR.'
    fi
fi

echo '[*] Recherche de fichiers sensibles'

while IFS= read -r file; do
    fail "Fichier potentiellement sensible : $file"
done < <(
    find "$REPO_DIR" \
        -type f \
        \( \
            -name '*.key' \
            -o -name '*.pem' \
            -o -name '*.p12' \
            -o -name '.netrc' \
            -o -name '*.sqlite' \
            -o -name '*.sqlite3' \
            -o -name '*.db' \
        \) \
        -not -path "$REPO_DIR/.git/*"
)

echo '[*] Vérification de la séparation des dépôts'

for forbidden in \
    "$REPO_DIR/userfs" \
    "$REPO_DIR/inventory/packages" \
    "$REPO_DIR/rootfs/etc/sudoers.d"
do
    [[ ! -e "$forbidden" ]] ||
        fail "Répertoire interdit dans arch-system : $forbidden"
done

echo '[*] Vérification des templates'

grep -q '@ROOT_UUID@' \
    "$REPO_DIR/templates/fstab.btrfs" ||
    fail 'Placeholder @ROOT_UUID@ absent de fstab.btrfs.'

grep -q '@EFI_UUID@' \
    "$REPO_DIR/templates/fstab.btrfs" ||
    fail 'Placeholder @EFI_UUID@ absent de fstab.btrfs.'

grep -q '@ROOT_UUID@' \
    "$REPO_DIR/templates/limine.conf" ||
    fail 'Placeholder @ROOT_UUID@ absent de limine.conf.'

grep -q '@USER@' \
    "$REPO_DIR/templates/sudoers.d/batlimit" ||
    fail 'Placeholder @USER@ absent du sudoers batlimit.'

grep -q '@USER@' \
    "$REPO_DIR/templates/sudoers.d/vmware-stack" ||
    fail 'Placeholder @USER@ absent du sudoers VMware.'

if git -C "$REPO_DIR" \
    rev-parse --is-inside-work-tree >/dev/null 2>&1
then
    echo '[*] Contrôle du diff Git'
    git -C "$REPO_DIR" diff --check || status=1
fi

if (( status == 0 )); then
    echo '[+] Dépôt valide.'
else
    echo '[!] Le dépôt contient encore des erreurs.' >&2
fi

exit "$status"