scripts/setup/lib/validation.sh

# Validation helpers for interactive setup.

validate_uri() {
  local uri="$1"
  local db_type="$2"

  if [[ -z "$uri" ]]; then
    return 1
  fi

  case "$db_type" in
    postgresql)
      [[ "$uri" =~ ^postgres(ql)?://.+ ]]
      return $?; ;;
    neo4j)
      [[ "$uri" =~ ^(neo4j(\+s|\+ssc)?|bolt)://.+ ]]
      return $?; ;;
    mongodb)
      [[ "$uri" =~ ^mongodb(\+srv)?://.+ ]]
      return $?; ;;
    redis)
      [[ "$uri" =~ ^rediss?://.+ ]]
      return $?; ;;
    milvus|qdrant)
      [[ "$uri" =~ ^https?://.+ ]]
      return $?; ;;
    memgraph)
      [[ "$uri" =~ ^bolt://.+ ]]
      return $?; ;;
    *)
      return 1
      ;;
  esac
}

validate_api_key() {
  local key="$1"
  local provider="$2"

  if [[ -z "$key" ]]; then
    return 1
  fi

  case "$provider" in
    openai|openrouter)
      return 0; ;;
    *)
      [[ ${#key} -ge 8 ]]
      return $?; ;;
  esac
}

validate_port() {
  local port="$1"

  if [[ ! "$port" =~ ^[0-9]+$ ]]; then
    return 1
  fi

  if (( port < 1 || port > 65535 )); then
    return 1
  fi

  return 0
}

validate_positive_integer() {
  local value="$1"

  if [[ ! "$value" =~ ^[0-9]+$ ]]; then
    return 1
  fi

  (( 10#$value > 0 ))
}

validate_non_negative_integer() {
  local value="$1"

  if [[ ! "$value" =~ ^[0-9]+$ ]]; then
    return 1
  fi

  (( 10#$value >= 0 ))
}

validate_non_empty() {
  local value="$1"

  [[ -n "$value" ]]
}

validate_existing_file() {
  local path="$1"

  [[ -n "$path" && -f "$path" ]]
}

check_storage_compatibility() {
  local kv_storage="$1"
  local vector_storage="$2"
  local graph_storage="$3"
  local doc_status_storage="$4"
  local warnings=()

  if [[ "$vector_storage" == "MongoVectorDBStorage" ]]; then
    warnings+=("MongoDB vector storage requires an Atlas-capable deployment with Atlas Search / Vector Search support.")
  fi

  if [[ "$graph_storage" == "Neo4JStorage" && "$kv_storage" == "JsonKVStorage" ]]; then
    warnings+=("Neo4j graph with JSON KV storage is fine for dev, but not ideal for production.")
  fi

  if [[ "$graph_storage" == "NetworkXStorage" ]]; then
    warnings+=("NetworkX graph storage is memory-bound and suited for small datasets only.")
  fi

  if [[ "$vector_storage" == "FaissVectorDBStorage" ]]; then
    warnings+=("Faiss vector storage is local-only and requires manual persistence management.")
  fi

  if [[ "$kv_storage" == "JsonKVStorage" || "$doc_status_storage" == "JsonDocStatusStorage" ]]; then
    warnings+=("JSON-based KV/doc status storage is recommended only for local development.")
  fi

  if ((${#warnings[@]} > 0)); then
    echo "${COLOR_YELLOW:-}Storage compatibility/performance warnings:${COLOR_RESET:-}" >&2
    for warning in "${warnings[@]}"; do
      echo "  - $warning" >&2
    done
  fi

  return 0
}

format_error() {
  local message="$1"
  local suggestion="${2:-}"

  echo "${COLOR_RED:-}Error:${COLOR_RESET:-} $message" >&2
  if [[ -n "$suggestion" ]]; then
    echo "${COLOR_YELLOW:-}Hint:${COLOR_RESET:-} $suggestion" >&2
  fi
}

contains_env_interpolation_syntax() {
  local value="$1"

  [[ "$value" == *'${'* ]]
}

is_sensitive_env_key() {
  local key="$1"

  case "$key" in
    AUTH_ACCOUNTS|*API_KEY*|*ACCESS_KEY*|*PUBLIC_KEY*|*SECRET*|*PASSWORD*|*TOKEN*)
      return 0
      ;;
    *)
      return 1
      ;;
  esac
}

validate_sensitive_env_literals() {
  local key value
  local invalid_keys=()

  for key in "${!ENV_VALUES[@]}"; do
    if ! is_sensitive_env_key "$key"; then
      continue
    fi

    value="${ENV_VALUES[$key]:-}"
    if [[ -n "$value" ]] && contains_env_interpolation_syntax "$value"; then
      invalid_keys+=("$key")
    fi
  done

  if ((${#invalid_keys[@]} > 0)); then
    format_error \
      "Sensitive values must not contain \${...} interpolation syntax: ${invalid_keys[*]}" \
      "Use literal values, plain \$ characters, or inject those secrets via runtime environment variables instead of .env."
    return 1
  fi

  return 0
}

validate_required_variables() {
  local storages=("$@")
  local missing=()
  local unknown=()
  local storage required var

  for storage in "${storages[@]}"; do
    if [[ -z "$storage" ]]; then
      continue
    fi
    if [[ ! -v "STORAGE_ENV_REQUIREMENTS[$storage]" ]]; then
      unknown+=("$storage")
      continue
    fi
    required="${STORAGE_ENV_REQUIREMENTS[$storage]}"
    if [[ -z "$required" ]]; then
      continue
    fi
    for var in $required; do
      if [[ -z "${ENV_VALUES[$var]:-}" ]]; then
        missing+=("$var")
      fi
    done
  done

  if ((${#unknown[@]} > 0)); then
    format_error \
      "Unsupported storage selections: ${unknown[*]}" \
      "Use a supported LightRAG storage class name or rerun setup to pick a valid backend."
    return 1
  fi

  if ((${#missing[@]} > 0)); then
    format_error "Missing required variables: ${missing[*]}" "Fill them in .env or re-run setup."
    return 1
  fi

  return 0
}

validate_opensearch_hosts_format() {
  local hosts="${1:-${ENV_VALUES[OPENSEARCH_HOSTS]:-}}"
  local entry=""
  local trimmed=""
  local has_host="no"
  local -a entries=()

  if [[ "$hosts" == *"://"* ]]; then
    format_error \
      "OPENSEARCH_HOSTS must use bare host:port entries, not URLs." \
      "Set comma-separated host:port values such as localhost:9200; control TLS with OPENSEARCH_USE_SSL."
    return 1
  fi

  IFS=',' read -r -a entries <<< "$hosts"
  for entry in "${entries[@]}"; do
    trimmed="${entry#"${entry%%[![:space:]]*}"}"
    trimmed="${trimmed%"${trimmed##*[![:space:]]}"}"
    if [[ -z "$trimmed" ]]; then
      format_error \
        "OPENSEARCH_HOSTS must not contain empty host entries." \
        "Use comma-separated host:port values such as localhost:9200 or host1:9200,host2:9200."
      return 1
    fi
    has_host="yes"
  done

  if [[ "$has_host" != "yes" ]]; then
    format_error \
      "OPENSEARCH_HOSTS must include at least one host:port entry." \
      "Set it to a value such as localhost:9200."
    return 1
  fi

  return 0
}

validate_opensearch_password_strength() {
  local password="${1:-${ENV_VALUES[OPENSEARCH_PASSWORD]:-}}"

  if [[ ${#password} -lt 8 || ! "$password" =~ [A-Z] || ! "$password" =~ [a-z] || ! "$password" =~ [0-9] || ! "$password" =~ [^A-Za-z0-9] ]]; then
    format_error \
      "OpenSearch requires a strong OPENSEARCH_PASSWORD." \
      "Use at least 8 characters with uppercase, lowercase, number, and special character."
    return 1
  fi

  return 0
}

validate_opensearch_config() {
  local deployment_mode="${1:-${ENV_VALUES[LIGHTRAG_SETUP_OPENSEARCH_DEPLOYMENT]:-}}"
  local hosts="${2:-${ENV_VALUES[OPENSEARCH_HOSTS]:-}}"
  local user="${3:-${ENV_VALUES[OPENSEARCH_USER]:-}}"
  local password="${4:-${ENV_VALUES[OPENSEARCH_PASSWORD]:-}}"
  local num_shards="${5-${ENV_VALUES[OPENSEARCH_NUMBER_OF_SHARDS]-1}}"
  local num_replicas="${6-${ENV_VALUES[OPENSEARCH_NUMBER_OF_REPLICAS]-0}}"

  if ! validate_opensearch_hosts_format "$hosts"; then
    return 1
  fi

  if [[ -z "$user" || -z "$password" ]]; then
    if [[ "$deployment_mode" == "docker" ]]; then
      format_error \
        "Bundled OpenSearch requires OPENSEARCH_USER and OPENSEARCH_PASSWORD." \
        "Set both variables or rerun setup; the managed Docker service starts with security enabled."
    else
      format_error \
        "OpenSearch requires both OPENSEARCH_USER and OPENSEARCH_PASSWORD." \
        "This setup wizard only supports authenticated OpenSearch clusters. Set both values or rerun setup."
    fi
    return 1
  fi

  if ! validate_opensearch_password_strength "$password"; then
    if [[ "$deployment_mode" == "docker" ]]; then
      echo "${COLOR_YELLOW:-}Hint:${COLOR_RESET:-} The managed Docker image also enforces this password strength at startup." >&2
    fi
    return 1
  fi

  if ! validate_positive_integer "$num_shards"; then
    format_error \
      "OPENSEARCH_NUMBER_OF_SHARDS must be a positive integer." \
      "Set it to 1 or greater, or rerun setup to regenerate the OpenSearch index settings."
    return 1
  fi

  if ! validate_non_negative_integer "$num_replicas"; then
    format_error \
      "OPENSEARCH_NUMBER_OF_REPLICAS must be a non-negative integer." \
      "Set it to 0 or greater, or rerun setup to regenerate the OpenSearch index settings."
    return 1
  fi

  return 0
}

validate_mongo_vector_storage_config() {
  local vector_storage="$1"
  local mongo_uri="${2:-${ENV_VALUES[MONGO_URI]:-}}"
  local mongo_deployment="${3:-${ENV_VALUES[LIGHTRAG_SETUP_MONGODB_DEPLOYMENT]:-}}"

  if [[ "$vector_storage" != "MongoVectorDBStorage" ]]; then
    return 0
  fi

  if [[ "$mongo_deployment" == "docker" ]]; then
    format_error \
      "MongoVectorDBStorage cannot use the local Docker MongoDB service managed by this setup wizard." \
      "That service is MongoDB Community Edition without Atlas Search / Vector Search support. Use an Atlas-capable MongoDB endpoint instead."
    return 1
  fi

  if ! validate_uri "$mongo_uri" mongodb; then
    format_error \
      "MongoVectorDBStorage requires a valid MongoDB URI." \
      "Set MONGO_URI to a mongodb:// or mongodb+srv:// endpoint that supports Atlas Search / Vector Search."
    return 1
  fi

  if [[ ! "$mongo_uri" =~ ^mongodb\+srv:// ]]; then
    format_error \
      "MongoVectorDBStorage requires a MongoDB Atlas URI." \
      "Set MONGO_URI to a mongodb+srv:// endpoint backed by Atlas Search / Vector Search."
    return 1
  fi

  return 0
}

validate_auth_accounts_format() {
  local auth_accounts="$1"
  local entry username password

  if [[ -z "$auth_accounts" ]]; then
    return 0
  fi

  if [[ "$auth_accounts" == ,* || "$auth_accounts" == *, || "$auth_accounts" == *",,"* ]]; then
    return 1
  fi

  IFS=',' read -r -a entries <<< "$auth_accounts"
  for entry in "${entries[@]}"; do
    if [[ -z "$entry" || "$entry" != *:* ]]; then
      return 1
    fi

    username="${entry%%:*}"
    password="${entry#*:}"
    if [[ -z "$username" || -z "$password" ]]; then
      return 1
    fi
  done

  return 0
}

validate_auth_accounts_password_safety() {
  local auth_accounts="$1"
  local entry password normalized_password

  if [[ -z "$auth_accounts" ]]; then
    return 0
  fi

  IFS=',' read -r -a entries <<< "$auth_accounts"
  for entry in "${entries[@]}"; do
    password="${entry#*:}"
    normalized_password="${password,,}"
    if [[ "$normalized_password" == admin* || "$normalized_password" == pass* ]]; then
      return 1
    fi
  done

  return 0
}

validate_auth_accounts_runtime_config() {
  local auth_accounts="$1"

  if [[ -z "$auth_accounts" ]]; then
    return 0
  fi

  if ! validate_auth_accounts_format "$auth_accounts"; then
    format_error \
      "AUTH_ACCOUNTS must use comma-separated user:password pairs." \
      "Use entries like admin:{bcrypt}<hash> or admin:secret,reader:another-secret."
    return 1
  fi

  return 0
}

whitelist_exposes_api_routes() {
  local whitelist_paths="$1"
  local entry trimmed_entry normalized_entry

  IFS=',' read -r -a entries <<< "$whitelist_paths"
  for entry in "${entries[@]}"; do
    trimmed_entry="${entry#"${entry%%[![:space:]]*}"}"
    trimmed_entry="${trimmed_entry%"${trimmed_entry##*[![:space:]]}"}"
    normalized_entry="$trimmed_entry"

    if [[ "$normalized_entry" == *"/*" ]]; then
      normalized_entry="${normalized_entry%/*}"
    fi
    if [[ "$normalized_entry" != "/" ]]; then
      normalized_entry="${normalized_entry%/}"
    fi

    if [[ "$normalized_entry" == "/api" || "$normalized_entry" == /api/* ]]; then
      return 0
    fi
  done

  return 1
}

validate_security_config() {
  local auth_accounts="${1:-${ENV_VALUES[AUTH_ACCOUNTS]:-}}"
  local token_secret="${2:-${ENV_VALUES[TOKEN_SECRET]:-}}"
  local _api_key="${3:-${ENV_VALUES[LIGHTRAG_API_KEY]:-}}"
  local _unused_flag="${4:-no}"
  local _unused_whitelist="${5:-${ENV_VALUES[WHITELIST_PATHS]:-}}"
  local _unused_whitelist_is_set="${6:-}"

  if [[ -z "$auth_accounts" ]]; then
    return 0
  fi

  if ! validate_auth_accounts_format "$auth_accounts"; then
    format_error \
      "AUTH_ACCOUNTS must use comma-separated user:password pairs." \
      "Use entries like admin:{bcrypt}<hash> or admin:secret,reader:another-secret."
    return 1
  fi

  if ! validate_auth_accounts_password_safety "$auth_accounts"; then
    format_error \
      "AUTH_ACCOUNTS passwords must not start with 'admin' or 'pass'." \
      "Choose a less predictable password or use lightrag-hash-password to generate a {bcrypt} value."
    return 1
  fi

  if [[ -z "$token_secret" ]]; then
    format_error \
      "AUTH_ACCOUNTS is set but TOKEN_SECRET is missing." \
      "Set a non-empty JWT signing secret before enabling account-based authentication."
    return 1
  fi

  if [[ "$token_secret" == "lightrag-jwt-default-secret-key!" ]]; then
    format_error \
      "TOKEN_SECRET must not use the built-in default value when AUTH_ACCOUNTS is enabled." \
      "Generate a unique JWT signing secret and update TOKEN_SECRET."
    return 1
  fi

  return 0
}

check_docker_availability() {
  if ! command -v docker >/dev/null 2>&1; then
    format_error "Docker is not installed or not in PATH." "Install Docker or disable docker service generation."
    return 1
  fi

  if ! docker compose version >/dev/null 2>&1; then
    format_error "Docker Compose is not available." "Install the Docker Compose plugin or use docker-compose."
    return 1
  fi

  return 0
}