#!/usr/bin/env bash
set -uo pipefail
source '{{ healthcheck_install_root }}/health-common.sh'

require_command docker
require_command curl
require_command openssl
require_command python3
check_compose

health="$(docker compose --project-directory '{{ compose_project_dir }}' ps --format json 2>&1)" || record critical 'compose_status_unavailable'
grep -Fq 'vaultwarden' <<<"$health" || record critical 'vaultwarden_missing'
grep -Fq 'vw-db' <<<"$health" || record critical 'postgres_missing'

check_https 'https://auth.wsvc.info/' '^200$'
check_tls_days auth.wsvc.info 443

# Read effective config from the mounted vw-data dir on the host and run the
# SMTP AUTH probe from the host (the vaultwarden image has no python3; the
# host does). Never print the SMTP password.
smtp_result="$(python3 - <<'PY' 2>&1
import json, pathlib, smtplib, ssl
cfg=json.loads(pathlib.Path('{{ compose_project_dir }}/vw-data/config.json').read_text())
host=cfg.get('smtp_host'); port=int(cfg.get('smtp_port') or 0)
user=cfg.get('smtp_username')
smtp_secret=cfg.get('smtp_password')
if not all((host, port, user, smtp_secret)):
    raise SystemExit('smtp_config_incomplete')
with smtplib.SMTP(host, port, timeout=15) as client:
    client.ehlo(); client.starttls(context=ssl.create_default_context()); client.ehlo(); client.login(user, smtp_secret)
print('smtp_auth_ok')
PY
)"
grep -Fqx 'smtp_auth_ok' <<<"$smtp_result" || record critical 'smtp_auth_failed'

# Detect drift without exposing the values: matching SHA-256 digests are used only
# internally and the result is a boolean.
drift_result="$(python3 - <<'PY'
import hashlib, json, pathlib, re
root=pathlib.Path('{{ compose_project_dir }}')
env=root.joinpath('.env').read_text()
match=re.search(r'^SMTP_PASSWORD=(.*)$', env, re.M)
config=json.loads(root.joinpath('vw-data/config.json').read_text())
value=(match.group(1).strip().strip('"\'') if match else '')
print('smtp_password_match' if value and value == (config.get('smtp_password') or '') else 'smtp_password_drift')
PY
 2>&1)" || record unknown 'smtp_drift_check_failed'
grep -Fqx 'smtp_password_match' <<<"$drift_result" || record critical 'smtp_password_drift'

check_backup_freshness '*/backups/*.sql.gz'
emit_result
exit "$EXIT_CODE"