#!/usr/bin/env sh
set -eu

production_dependencies="$(GOWORK=off go list -deps ./cmd/gateway)"
test_dependencies="$(GOWORK=off go list -deps -test ./gateway/... ./cmd/gateway/...)"
release_verifier_dependencies="$(
  GOWORK=off go list -deps -f '{{if not .Standard}}{{.ImportPath}}{{end}}' ./cmd/gateway-release-verifier |
    sed '/^$/d' |
    sort
)"
expected_release_verifier_dependencies="$(
  printf '%s\n' \
    github.com/pingcap-inc/nexuscrm-api-host/cmd/gateway-release-verifier \
    github.com/pingcap-inc/nexuscrm-api-host/internal/gatewayrelease |
    sort
)"
if [ "$release_verifier_dependencies" != "$expected_release_verifier_dependencies" ]; then
  echo "Gateway signer verifier must remain local and stdlib-only:" >&2
  printf '%s\n' "$release_verifier_dependencies" >&2
  exit 1
fi

for forbidden in \
  github.com/pingcap-inc/nexuscrm-app-packs \
  github.com/pingcap-inc/nexuscrm-controlplane \
  github.com/pingcap-inc/nexuscrm-connectors \
  github.com/pingcap-inc/nexuscrm-pingcap-pack \
  github.com/nexuscrm
do
  for dependency_set in "$production_dependencies" "$test_dependencies"
  do
    if printf '%s\n' "$dependency_set" | grep -E "^${forbidden}(/|$)" >/dev/null; then
      echo "forbidden Gateway dependency: $forbidden" >&2
      exit 1
    fi
  done
done

production_files="$(find gateway cmd/gateway -type f -name '*.go' ! -name '*_test.go' -print)"
if grep -E -i -n 'salesforce|sfcrm|record[-_]access|sobject|services/data|ui-api' $production_files; then
  echo "product semantics found in the generic Gateway production closure" >&2
  exit 1
fi