#!/usr/bin/env bash
# Tripwire: fail if a deployment-lab address appears in tracked source.
#
# Cheap insurance, not the real check. The semantic tests in
# `openfut-adapter-fifa17/tests/deployment_config.rs` are what actually prove
# the configuration propagates — they use two RFC 5737 TEST-NET addresses and
# deliberately set bind != advertise. This grep only stops the lab's own subnet
# from creeping back into source months from now, when the reasoning behind the
# audit has been forgotten.
#
# Deployment configuration is expected to contain real addresses; it lives in
# gitignored files (docker .env) and is therefore never scanned here.
set -uo pipefail
cd "$(dirname "$(readlink -f "$0")")/.."

# The lab subnet. Override for a different deployment.
PATTERN="${OPENFUT_LAB_SUBNET_RE:-10\.10\.0\.[0-9]+}"

# Historical records may legitimately state what a past deployment actually was;
# rewriting them would falsify the record. Allowlisted BY PATH, never by pattern.
ALLOW='^fifa17-recon/docs/BASELINE-python-2026-08-10\.md$'

hits="$(git ls-files -z | xargs -0 grep -lE "$PATTERN" 2>/dev/null | grep -vE "$ALLOW" || true)"

if [[ -z "$hits" ]]; then
  echo "OK: no lab addresses in tracked source"
  exit 0
fi

echo "FAIL: lab address(es) found in tracked source:" >&2
for f in $hits; do
  echo "  $f" >&2
  grep -nE "$PATTERN" "$f" | sed 's/^/      /' >&2
done
cat >&2 <<'MSG'

Deployment addresses belong in gitignored configuration, not in source.
Use an RFC 5737 TEST-NET address in examples and tests:
  192.0.2.0/24   198.51.100.0/24   203.0.113.0/24
If this is a historical record that must state a real past deployment, add its
path to ALLOW in this script and say why.
MSG
exit 1