#!/usr/bin/env bash
set -euo pipefail

export GOWORK=off
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
cd "$root/backend"

deps=$(go list -deps ./cmd/integration-service/...)

# The provider-facing Integration role owns connector protocol and external
# effects. It may use the neutral Platform client, but must never acquire a
# process-local Runtime/Flow/record engine or an L1/distribution dependency.
for forbidden in \
  github.com/nexuscrm/automation \
  github.com/nexuscrm/metadata \
  github.com/nexuscrm/records \
  github.com/nexuscrm/backend/distributions \
  github.com/nexuscrm/backend/internal/runtimeapi \
  github.com/nexuscrm/backend/internal/runtimeassembly \
  github.com/nexuscrm/backend/internal/runtimeproduction \
  github.com/nexuscrm/backend/internal/runtimeworker \
  github.com/nexuscrm/backend/pkg/serverruntime \
  github.com/pingcap-inc/nexuscrm-app-packs \
  dialect-sf-crm \
  issue-tracker; do
  if grep -Fq "$forbidden" <<<"$deps"; then
    echo "Integration process dependency closure contains forbidden owner: $forbidden" >&2
    exit 1
  fi
done

for required in \
  github.com/nexuscrm/db \
  github.com/nexuscrm/outbound/http_client \
  github.com/pingcap-inc/nexuscrm-api-host/processhttp \
  github.com/pingcap-inc/nexuscrm-api-host/runtimegrpc \
  github.com/pingcap-inc/nexuscrm-connectors/application/connectors \
  github.com/pingcap-inc/nexuscrm-connectors/features/connector/runtimehandoff; do
  if ! grep -Fxq "$required" <<<"$deps"; then
    echo "Integration process dependency closure lost required owner: $required" >&2
    exit 1
  fi
done

integration_dockerfile="$root/infra/integration.Dockerfile"
integration_dockerignore="$root/infra/integration.Dockerfile.dockerignore"
integration_smoke="$root/scripts/ci/integration-image-smoke.sh"
test -f "$integration_dockerfile"
test -f "$integration_dockerignore"
test -x "$integration_smoke"
for required in \
  './cmd/integration-service/' \
  'dev.nexuscrm.integration.role="integration-service"' \
  'ENTRYPOINT ["/usr/local/bin/integration-service"]'; do
  if ! grep -Fq -- "$required" "$integration_dockerfile"; then
    echo "Integration image lost release contract: $required" >&2
    exit 1
  fi
done
for required in \
  '**' \
  '!backend/cmd/integration-service/**' \
  '!backend/internal/integrationservice/**' \
  '!infra/integration.Dockerfile' \
  '**/*_test.go' \
  '**/testdata/**'; do
  if ! grep -Fxq -- "$required" "$integration_dockerignore"; then
    echo "Integration image context lost allowlist boundary: $required" >&2
    exit 1
  fi
done
for forbidden in \
  '!backend/distributions/**' \
  '!backend/internal/runtimeapi/**' \
  '!backend/internal/runtimeworker/**' \
  '!nexuscrm-app-packs/**' \
  '!dialects/**' \
  '!frontend/**'; do
  if grep -Fxq -- "$forbidden" "$integration_dockerignore"; then
    echo "Integration image context admitted a foreign owner: $forbidden" >&2
    exit 1
  fi
done
for forbidden in './cmd/runtime-api/' './cmd/runtime-worker/'; do
  if grep -Fq -- "$forbidden" "$integration_dockerfile"; then
    echo "Integration image build closure compiles Runtime owner: $forbidden" >&2
    exit 1
  fi
done

# Integration is one role of the shared L0 Engine release; it has no separate
# publication authority or signing policy.
"$root/scripts/ci/check-l0-engine-release-boundary.sh"

echo "Integration process dependency boundary passed"