#include "sdkconfig.h"

/* Check resolved configuration, not just defaults: existing sdkconfig files
 * survive default changes. Crash memory may contain credentials and UART data.
 * See docs/security_hardening.md before changing this supported-build policy. */
#if !defined(CONFIG_ESP_COREDUMP_ENABLE_TO_NONE) || !CONFIG_ESP_COREDUMP_ENABLE_TO_NONE
#error "Security policy: select CONFIG_ESP_COREDUMP_ENABLE_TO_NONE=y"
#endif

#if CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH || CONFIG_ESP_COREDUMP_ENABLE_TO_UART || CONFIG_ESP_COREDUMP_ENABLE
#error "Security policy: flash and UART core dumps must be disabled"
#endif

#if !defined(CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT) || !CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT
#error "Security policy: select CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT=y"
#endif

#if CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT || CONFIG_ESP_SYSTEM_PANIC_PRINT_REBOOT || CONFIG_ESP_SYSTEM_PANIC_GDBSTUB
#error "Security policy: panic register output and panic GDB stub must be disabled"
#endif

#if CONFIG_ESP_SYSTEM_GDBSTUB_RUNTIME
#error "Security policy: runtime GDB stub must be disabled"
#endif

/* Prevent a connected debugger from replacing panic recovery with a halt.
 * This is not a physical JTAG access restriction and does not change eFuses. */
#if CONFIG_ESP_DEBUG_OCDAWARE || CONFIG_FREERTOS_DEBUG_OCDAWARE
#error "Security policy: JTAG/OCD-aware panic handling must be disabled"
#endif