#!/usr/bin/env bash
# Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
# Caracal, a product of Garudex Labs
#
# Verifies redis: all streams and consumer groups exist; provisioner idempotency.
# Usage: REDIS_HOST=localhost REDIS_PORT=6379 REDIS_PASSWORD=secret bash verify.sh

set -euo pipefail

HOST="${REDIS_HOST:-localhost}"
PORT="${REDIS_PORT:-6379}"
PASS="${REDIS_PASSWORD:-}"

if [ -n "${REDIS_PASSWORD_FILE:-}" ]; then
  PASS="$(cat "$REDIS_PASSWORD_FILE")"
fi

if [ -z "$PASS" ]; then
  echo "REDIS_PASSWORD_FILE or REDIS_PASSWORD required" >&2
  exit 1
fi

export REDISCLI_AUTH="$PASS"

cli() { redis-cli -h "$HOST" -p "$PORT" --no-auth-warning "$@"; }

STREAMS=(
  "caracal.audit.events"
  "caracal.audit.events.dlq"
  "caracal.policy.invalidate"
  "caracal.sessions.revoke"
  "caracal.keys.invalidate"
  "caracal.agents.lifecycle"
  "caracal.invocations.lifecycle"
  "caracal.delegations.invalidate"
  "caracal.providers.ratelimit"
)
EXPECTED_GROUPS=(
  "caracal.audit.events:audit-ingestor"
  "caracal.audit.events:siem-export"
  "caracal.audit.events.dlq:audit-dlq-observer"
  "caracal.policy.invalidate:opa-engine"
  "caracal.sessions.revoke:sts-revocation"
  "caracal.keys.invalidate:sts-keys"
  "caracal.agents.lifecycle:coordinator-relay"
  "caracal.invocations.lifecycle:invocations-observer"
  "caracal.delegations.invalidate:delegations-observer"
)

echo "=== Streams exist ==="
for s in "${STREAMS[@]}"; do
  TYPE=$(cli TYPE "$s")
  if [ "$TYPE" = "stream" ]; then
    echo "  $s OK"
  else
    echo "  FAIL: $s type=$TYPE (expected stream)"
    exit 1
  fi
done

echo ""
echo "=== Consumer groups exist ==="
for entry in "${EXPECTED_GROUPS[@]}"; do
  STREAM="${entry%%:*}"
  GROUP="${entry##*:}"
  FOUND=$(cli XINFO GROUPS "$STREAM" | grep -c "$GROUP" || true)
  if [ "$FOUND" -ge 1 ]; then
    echo "  $STREAM/$GROUP OK"
  else
    echo "  FAIL: $STREAM/$GROUP not found"
    exit 1
  fi
done

echo ""
echo "=== Idempotency: re-run provisioner ==="
REDIS_HOST="$HOST" REDIS_PORT="$PORT" REDIS_PASSWORD="$PASS" bash "$(dirname "$0")/../provision-streams.sh"
echo "  Re-run completed without error"

echo ""
echo "=== PASS ==="
