innercontext/scripts/validate-env.sh

#!/bin/bash
#
# Validate environment variables for innercontext deployment
# Checks both shared directory (persistent config) and current release (symlinks)
#

set -euo pipefail

# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Shared directory (persistent configuration)
SHARED_BACKEND_ENV="/opt/innercontext/shared/backend/.env"
SHARED_FRONTEND_ENV="/opt/innercontext/shared/frontend/.env.production"

# Current release (should be symlinks to shared)
CURRENT_BACKEND_ENV="/opt/innercontext/current/backend/.env"
CURRENT_FRONTEND_ENV="/opt/innercontext/current/frontend/.env.production"

errors=0
warnings=0

log_error() {
    echo -e "${RED}✗${NC} $1"
    errors=$((errors + 1))
}

log_success() {
    echo -e "${GREEN}✓${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}⚠${NC} $1"
    warnings=$((warnings + 1))
}

check_symlink() {
    local symlink_path=$1
    local expected_target=$2
    
    if [ ! -L "$symlink_path" ]; then
        log_error "Not a symlink: $symlink_path"
        return 1
    fi
    
    local actual_target=$(readlink "$symlink_path")
    if [ "$actual_target" != "$expected_target" ]; then
        log_warning "Symlink target mismatch: $symlink_path -> $actual_target (expected: $expected_target)"
    else
        log_success "Symlink correct: $symlink_path -> $actual_target"
    fi
}

check_var() {
    local file=$1
    local var_name=$2
    local optional=${3:-false}
    
    if [ ! -f "$file" ]; then
        log_error "File not found: $file"
        return 1
    fi
    
    # Check if variable exists and is not empty
    if grep -q "^${var_name}=" "$file"; then
        local value=$(grep "^${var_name}=" "$file" | cut -d'=' -f2-)
        if [ -z "$value" ]; then
            if [ "$optional" = true ]; then
                log_warning "$var_name is empty in $file (optional)"
            else
                log_error "$var_name is empty in $file"
            fi
        else
            log_success "$var_name is set"
        fi
    else
        if [ "$optional" = true ]; then
            log_warning "$var_name not found in $file (optional)"
        else
            log_error "$var_name not found in $file"
        fi
    fi
}

echo "=== Validating Shared Directory Structure ==="

# Check shared directory exists
if [ -d "/opt/innercontext/shared" ]; then
    log_success "Shared directory exists: /opt/innercontext/shared"
else
    log_error "Shared directory not found: /opt/innercontext/shared"
fi

# Check shared backend .env
if [ -f "$SHARED_BACKEND_ENV" ]; then
    log_success "Shared backend .env exists: $SHARED_BACKEND_ENV"
else
    log_error "Shared backend .env not found: $SHARED_BACKEND_ENV"
fi

# Check shared frontend .env.production
if [ -f "$SHARED_FRONTEND_ENV" ]; then
    log_success "Shared frontend .env.production exists: $SHARED_FRONTEND_ENV"
else
    log_error "Shared frontend .env.production not found: $SHARED_FRONTEND_ENV"
fi

echo ""
echo "=== Validating Symlinks in Current Release ==="

# Check current release symlinks point to shared directory
if [ -e "$CURRENT_BACKEND_ENV" ]; then
    check_symlink "$CURRENT_BACKEND_ENV" "../../../shared/backend/.env"
else
    log_error "Current backend .env not found: $CURRENT_BACKEND_ENV"
fi

if [ -e "$CURRENT_FRONTEND_ENV" ]; then
    check_symlink "$CURRENT_FRONTEND_ENV" "../../../shared/frontend/.env.production"
else
    log_error "Current frontend .env.production not found: $CURRENT_FRONTEND_ENV"
fi

echo ""
echo "=== Validating Backend Environment Variables ==="
if [ -f "$SHARED_BACKEND_ENV" ]; then
    check_var "$SHARED_BACKEND_ENV" "DATABASE_URL"
    check_var "$SHARED_BACKEND_ENV" "GEMINI_API_KEY"
    check_var "$SHARED_BACKEND_ENV" "LOG_LEVEL" true
    check_var "$SHARED_BACKEND_ENV" "CORS_ORIGINS" true

    # OIDC Configuration
    check_var "$SHARED_BACKEND_ENV" "OIDC_ISSUER"
    check_var "$SHARED_BACKEND_ENV" "OIDC_CLIENT_ID"
    check_var "$SHARED_BACKEND_ENV" "OIDC_DISCOVERY_URL"
    check_var "$SHARED_BACKEND_ENV" "OIDC_ADMIN_GROUPS"
    check_var "$SHARED_BACKEND_ENV" "OIDC_MEMBER_GROUPS"
    check_var "$SHARED_BACKEND_ENV" "OIDC_JWKS_CACHE_TTL_SECONDS" true

    # Bootstrap Admin (Optional, used for initial setup)
    check_var "$SHARED_BACKEND_ENV" "BOOTSTRAP_ADMIN_OIDC_ISSUER" true
    check_var "$SHARED_BACKEND_ENV" "BOOTSTRAP_ADMIN_OIDC_SUB" true
    check_var "$SHARED_BACKEND_ENV" "BOOTSTRAP_ADMIN_EMAIL" true
    check_var "$SHARED_BACKEND_ENV" "BOOTSTRAP_ADMIN_NAME" true
    check_var "$SHARED_BACKEND_ENV" "BOOTSTRAP_HOUSEHOLD_NAME" true
fi

echo ""
echo "=== Validating Frontend Environment Variables ==="
if [ -f "$SHARED_FRONTEND_ENV" ]; then
    check_var "$SHARED_FRONTEND_ENV" "PUBLIC_API_BASE"
    check_var "$SHARED_FRONTEND_ENV" "ORIGIN"

    # Session and OIDC
    check_var "$SHARED_FRONTEND_ENV" "SESSION_SECRET"
    check_var "$SHARED_FRONTEND_ENV" "OIDC_ISSUER"
    check_var "$SHARED_FRONTEND_ENV" "OIDC_CLIENT_ID"
    check_var "$SHARED_FRONTEND_ENV" "OIDC_DISCOVERY_URL"
fi

echo ""
if [ $errors -eq 0 ]; then
    if [ $warnings -eq 0 ]; then
        echo -e "${GREEN}✓ All environment checks passed${NC}"
    else
        echo -e "${YELLOW}⚠ Environment validation passed with $warnings warning(s)${NC}"
    fi
    exit 0
else
    echo -e "${RED}✗ Found $errors error(s) in environment configuration${NC}"
    if [ $warnings -gt 0 ]; then
        echo -e "${YELLOW}  And $warnings warning(s)${NC}"
    fi
    exit 1
fi