#!/bin/sh
set -eu

compose_file="${1:-/workspace/docker-compose.yml}"

awk '
    /^[[:space:]]{2}wordpress:/ {
        in_wordpress = 1
        next
    }
    in_wordpress && /^[[:space:]]{2}[A-Za-z0-9_-]+:/ {
        in_wordpress = 0
    }
    in_wordpress && /^[[:space:]]{4}ports:/ {
        print "The wordpress service must not publish host ports; route traffic through proxy only." > "/dev/stderr"
        exit 1
    }
' "$compose_file"

grep -q 'azionelab-apache-hardening.conf' /workspace/wordpress/Dockerfile || {
    echo "The WordPress image must install Apache hardening rules." >&2
    exit 1
}

grep -q 'wp-content/(uploads|files)' /workspace/wordpress/apache-hardening.conf || {
    echo "Apache hardening must block PHP execution below uploads/files." >&2
    exit 1
}

grep -q "'publicly_queryable'[[:space:]]*=>[[:space:]]*false" /workspace/wordpress/mu-plugins/azionelab-content.php || {
    echo "Structured show content must not be exposed as standalone public routes." >&2
    exit 1
}