#!/usr/bin/env bash
# Exit non-zero if tracked or staged files contain anything shaped like a credential.
# Fails closed: no files to scan, or a pattern that misses a planted sample, is a failure.
set -u
cd "$(dirname "$0")/.."
RE='ed25519:[1-9A-HJ-NP-Za-km-z]{70,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|-----BEGIN [A-Z ]*PRIVATE KEY|[0-9]{8,12}:AA[A-Za-z0-9_-]{30,}|(api[_-]?key|secret|password|private[_-]?key|seed)["'"'"' ]*[:=]["'"'"' ]*[A-Za-z0-9+/_-]{24,}|CLOUDFLARE_API_TOKEN=[A-Za-z0-9_-]{20,}|swiftbotlabs@gmail'

# Positive control: the pattern must catch planted samples (built here, never stored whole).
for sample in "ghp_$(printf 'a%.0s' {1..24})" "glpat-$(printf 'b%.0s' {1..24})" "ed25519:$(printf '9%.0s' {1..80})" "-----BEGIN ""PRIVATE KEY"; do
  printf '%s\n' "$sample" | grep -q -E "$RE" || { echo "secret scan: pattern misses a planted sample"; exit 1; }
done

files=$(git ls-files --cached --others --exclude-standard | grep -v -E '^(Cargo\.lock|package-lock\.json|web/vendor/|worker/package-lock\.json)' )
[ -z "$files" ] && { echo "secret scan: no files to scan"; exit 1; }
# Allowed: the scan itself, and the public quote signature in the recorded 1Click fixture
# (a signature has the same shape as a key, but it is public by design).
hits=$(echo "$files" | tr '\n' '\0' | xargs -0 grep -n -I -E "$RE" 2>/dev/null \
  | grep -v -E '^scripts/secret-scan\.sh:' \
  | grep -v -E '^test/fixtures/1click-dry-quote\.json:[0-9]+:  "signature": "ed25519:[1-9A-HJ-NP-Za-km-z]+",$')
if [ -n "$hits" ]; then
  echo "SECRET SCAN HITS:"; echo "$hits" | cut -c1-160; exit 1
fi
echo "secret scan: 0 hits in $(echo "$files" | wc -l) files, planted samples caught"