#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"

echo "[1/3] Check critical env defaults"
if [[ "${JWT_SECRET:-}" == "change_me" ]]; then
  echo "[WARN] JWT_SECRET should not be change_me in non-dev environments"
fi

if [[ "${ERP_SYNC_ENABLED:-false}" != "false" ]]; then
  echo "[WARN] ERP_SYNC_ENABLED is not false; ensure feature-flag governance is enabled"
fi

if [[ "${INVOICE_VERIFICATION_ENABLED:-false}" != "false" ]]; then
  echo "[WARN] INVOICE_VERIFICATION_ENABLED is not false; ensure rollout is controlled"
fi

echo "[2/3] Basic static hardening checks"
node --check src/routes/auth.js
node --check src/routes/integrations.js
node --check src/routes/invoicePool/verification.js
node --check src/services/featureFlags/index.js

echo "[3/3] Dependency audit (non-blocking)"
if command -v npm >/dev/null 2>&1; then
  npm audit --omit=dev --audit-level=high || true
fi

echo "[OK] Security baseline script completed"