#!/usr/bin/env bash
# Lints, schema-checks and tests every rule and gate.

set -euo pipefail

source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"

fail() {
  echo "FAIL: $1" >&2
  exit 1
}

# Rego formatting.
echo "==> opa fmt --fail"
"$OPA" fmt --fail --diff "$POLICIES_DIR" || fail "rego files are not formatted (run 'make fmt' or 'opa fmt -w')"

# Lint with regal if available.
if command -v regal >/dev/null 2>&1; then
  echo "==> regal lint"
  regal lint "$POLICIES_DIR" --format github || fail "regal lint found issues"
else
  echo "==> regal not found, skipping"
fi

RULES_ARG=""
rule_dirs=( "$POLICIES_DIR"/rules/*/ )
[ "${#rule_dirs[@]}" -gt 0 ] && [ -d "${rule_dirs[0]}" ] || fail "no rules found"

# Schema-check + unit tests per rule (runs are isolated so each rule's scenarios.json loads at data.scenarios).
for d in "${rule_dirs[@]}"; do
  name="$(basename "$d")"
  echo "==> check ${name}"
  "$OPA" check --strict --schema "$d/schema" "$d/policy.rego" "$d/policy_test.rego" || fail "check ${name}"
  echo "==> test ${name}"
  "$OPA" test "$d/policy.rego" "$d/policy_test.rego" "$d/scenarios.json" || fail "test ${name}"
  RULES_ARG="$RULES_ARG $d/policy.rego"
done

# Gates: check + tests with all rule policy.rego files loaded so data.rules.* resolves.
gate_dirs=( "$POLICIES_DIR"/gates/*/ )
for g in "${gate_dirs[@]}"; do
  [ -d "$g" ] || continue
  name="$(basename "$g")"
  echo "==> check ${name}"
  "$OPA" check --strict --schema "$g/schema" "$g/gate_test.rego" || fail "check ${name}"
  echo "==> test ${name}"
  # shellcheck disable=SC2086
  "$OPA" test "$g/gate_test.rego" "$g/scenarios.json" $RULES_ARG || fail "test ${name}"
done

echo "All checks passed."