/**
 * Boot-time production safety guards (D-08).
 *
 * Exported as a standalone function so it can be unit-tested without
 * forking a process or importing the full app module graph.
 *
 * Call assertNotDevBypassInProduction() as the FIRST statement inside
 * the isMainModule() block in index.ts, before VAPID config, workers,
 * or serve(). Placement after any network/DB calls would allow a misconfigured
 * production container to partially start before the guard fires.
 */

/**
 * Refuses to start the process when NODE_ENV==='production' AND
 * DEV_AUTH_BYPASS==='true'.
 *
 * Rationale (D-07 + D-08): The production Dockerfile bakes NODE_ENV=production,
 * engaging the devBypass.ts hard guard. This boot guard is defense-in-depth — it
 * converts a silent misconfiguration (operator accidentally sets DEV_AUTH_BYPASS=true
 * in the production compose) into an immediate, loud, non-zero-exit failure instead
 * of a silently bypassed auth layer.
 *
 * The function evaluates env vars at call time (when the app starts), not at import
 * time, so the test suite can set env vars before calling it without module-cache tricks.
 */
export function assertNotDevBypassInProduction(): void {
  if (process.env.NODE_ENV === 'production' && process.env.DEV_AUTH_BYPASS === 'true') {
    console.error(
      '[FATAL] DEV_AUTH_BYPASS=true is set in a production environment. ' +
        'This configuration is forbidden. Refusing to start.',
    );
    process.exit(1);
  }
}
