#!/usr/bin/env bash
# The operations console must never touch the data plane. This is the grep that says so.
#
# There is no linter and no unit-test runner in this repository, and deploy.sh runs none of the
# guard scripts — so this, like scripts/check-identity.sh, is a habit rather than an enforcement.
# The enforcement is the ops_ro database role. This script exists so a mistake is caught before it
# reaches the role, and so the reasoning is written down where the next person will read it.
#
# Rules:
#   1. Nothing under app/ops/ imports the main database client or names `prisma.` directly. Pages
#      and routes there call lib/ops/* functions, which decide which client is right.
#   2. Nothing under app/ops/ or lib/ops/ imports buildSnapshot, exportBackup or useSnap — those
#      three ARE the data plane: one facility's whole register, history and stock in one call.
#   3. lib/ops/projections.ts, the one module that reads across facilities, uses opsDb() and never
#      the main client.
#   4. revealDb() — the role that can read a coordinator's contacts — is called from
#      lib/ops/reveal.ts and nowhere else, and that module reads only the three contact columns.
set -u
cd "$(dirname "$0")/.." || exit 1
bad=0

if grep -rn --include='*.ts' --include='*.tsx' -E "from \"@/lib/db\"|from \"\.\./db\"|from \"\.\./\.\./db\"|\bprisma\." app/ops/ 2>/dev/null; then
  echo "check-ops: app/ops/ must not reach the main database client directly (rule 1)"; bad=1
fi

if grep -rn --include='*.ts' --include='*.tsx' -E "buildSnapshot|exportBackup|useSnap|SnapshotProvider" app/ops/ lib/ops/ 2>/dev/null; then
  echo "check-ops: the console must not import the data plane (rule 2)"; bad=1
fi

if [ -f lib/ops/projections.ts ] && grep -n -E "from \"\.\./db\"|from \"@/lib/db\"|\bprisma\." lib/ops/projections.ts; then
  echo "check-ops: projections.ts must read through opsDb() only (rule 3)"; bad=1
fi

if grep -rn --include='*.ts' --include='*.tsx' -E "\brevealDb\(" app/ lib/ 2>/dev/null | grep -v -E "^lib/ops/(db|reveal)\.ts:"; then
  echo "check-ops: revealDb() may only be called from lib/ops/reveal.ts (rule 4)"; bad=1
fi
if [ -f lib/ops/reveal.ts ] && grep -n -P "revealDb\(\)\.(?!facility\b)" lib/ops/reveal.ts 2>/dev/null; then
  echo "check-ops: reveal.ts may read the Facility table only (rule 4)"; bad=1
fi

if [ "$bad" -eq 0 ]; then echo "check-ops: clean"; fi
exit "$bad"