#!/bin/sh
# Fail closed: require explicit security settings, independent of upstream
# defaults and JSON formatting. Never print the operator's configuration.
if ! jq -e -s '
    length == 1 and
    (.[0] | type == "object" and
      .localAuthBypassEnabled == false and .apiRestricted == true)
' "$1" >/dev/null 2>&1; then
    echo 'ERROR: settings must be one JSON object with localAuthBypassEnabled=false and apiRestricted=true' >&2
    exit 78
fi