const PLACEHOLDERS = new Set([
  '',
  'change-me-in-production',
  'farma-clic-secret-key-change-in-production',
  'replace-me',
  'dev-ingest-key-change-me',
])

export function validateProductionEnv(env = process.env) {
  if (env.NODE_ENV !== 'production') return

  const required = [
    ['SESSION_SECRET', env.SESSION_SECRET],
    ['CORS_ORIGIN', env.CORS_ORIGIN],
  ]

  for (const [name, value] of required) {
    if (!value || PLACEHOLDERS.has(value)) {
      throw new Error(`${name} must be set to a non-placeholder value in production`)
    }
  }

  if (env.CORS_ORIGIN.includes('localhost') || env.CORS_ORIGIN.includes('127.0.0.1')) {
    throw new Error('CORS_ORIGIN must not point to localhost in production')
  }

  if (!env.PG_URL && (!env.PG_PASSWORD || PLACEHOLDERS.has(env.PG_PASSWORD))) {
    throw new Error('PG_URL or PG_PASSWORD must be set to a non-placeholder value in production')
  }
}