#!/usr/bin/env bash
set -Eeuo pipefail

config=${1:?Usage: lesson-38-verify.sh PATH_TO_CONFIG}
[[ -f "$config" ]] || { echo "FAIL configuration not found"; exit 1; }

check() {
  local label=$1 expected=$2 query=$3 actual
  actual="$(yq -r "$query" "$config")"
  if [[ "$actual" == "$expected" ]]; then echo "PASS $label"; else echo "FAIL $label (got: $actual)"; fi
}

check 'anonymous authentication disabled' false '.authentication.anonymous.enabled'
check 'webhook authentication enabled' true '.authentication.webhook.enabled'
check 'webhook authorization selected' Webhook '.authorization.mode'
check 'read-only port disabled' 0 '.readOnlyPort'
check 'certificate rotation enabled' true '.rotateCertificates'