#!/usr/bin/env bash
# Pre-commit hook: secret scan + syntax check on staged TypeScript/JavaScript files.
# Use `git commit --no-verify` to bypass for confirmed false positives.

set -u

REPO_ROOT="$(git rev-parse --show-toplevel)"
cd "$REPO_ROOT" || exit 1

# --- 1. Secret scan ---
# Patterns for common credentials. Scans only added lines in the staged diff.
#
# Two passes because case-sensitivity differs. AWS keys are uppercase, sk- keys
# lowercase, PEM headers fixed, so those match case-SENSITIVELY: under -i,
# AKIA[0-9A-Z]{16} matches any mixed-case 20-char run, which random base64 in an
# embedded image blob hits ~6% of the time per 100KB and blocks real commits.
# Only the keyword=value patterns need -i.
SECRET_PATTERNS_CS='(AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9_-]{20,}|-----BEGIN (RSA|DSA|EC|OPENSSH|PGP)( PRIVATE)?( KEY| KEY BLOCK)?-----)'
SECRET_PATTERNS_CI='(api[_-]?key|api[_-]?secret|auth[_-]?token|secret[_-]?key|bearer[_-]?token|access[_-]?token|password)[[:space:]]*[:=][[:space:]]*["'"'"'][^"'"'"']{16,}["'"'"']'

# Read the diff on its own so a git failure is distinguishable from "grep
# matched nothing". Both end in a non-zero status, but only one of them means
# there is nothing to scan; piping them together and swallowing the result with
# `|| true` made a broken git look like a clean commit — the scan searched an
# empty string, found nothing, and the secret went in.
if ! staged_diff="$(git diff --cached -U0 --diff-filter=AM)"; then
  echo "pre-commit: cannot read the staged diff — refusing to skip the secret scan" >&2
  exit 1
fi

# The greps keep their `|| true`: exiting 1 on no match is their normal result.
added_lines="$(printf '%s\n' "$staged_diff" | grep '^+' | grep -v '^+++' || true)"

cs_hits="$(printf '%s\n' "$added_lines" | grep -nE  "$SECRET_PATTERNS_CS" || true)"
ci_hits="$(printf '%s\n' "$added_lines" | grep -niE "$SECRET_PATTERNS_CI" || true)"
# awk dedupes lines both passes matched, keeping first-seen order.
secret_hits="$(printf '%s\n%s' "$cs_hits" "$ci_hits" \
  | grep -v '^[[:space:]]*$' | awk '!seen[$0]++' || true)"

if [ -n "$secret_hits" ]; then
  echo "pre-commit: potential secret in staged changes:" >&2
  echo "$secret_hits" >&2
  echo "" >&2
  echo "Review the lines above. If this is a false positive (test fixture, documentation)," >&2
  echo "bypass with: git commit --no-verify" >&2
  exit 1
fi

# --- 2. Syntax check on staged TS/JS files ---
# Two checkers, because one tool can't do both jobs. `node --check` ignores
# --experimental-strip-types, so on TypeScript it is wrong in BOTH directions:
# it rejects valid TS (an `interface` reads as a syntax error) and accepts
# broken TS. Measured on node v26.4.0, 2026-07-23. tsc is the only correct
# parser for .ts; node is correct and much faster for .js.
# Same split as the secret scan above: a git failure must not read as "no files
# staged", which would skip the language check silently.
if ! staged_names="$(git diff --cached --name-only --diff-filter=AM)"; then
  echo "pre-commit: cannot read the staged file list — refusing to skip the check" >&2
  exit 1
fi

staged_js="$(printf '%s\n' "$staged_names" | grep -E '\.(js|jsx|mjs|cjs)$' || true)"
staged_ts="$(printf '%s\n' "$staged_names" | grep -E '\.(ts|tsx|mts|cts)$' || true)"

failed=""

if [ -n "$staged_js" ] && command -v node >/dev/null 2>&1; then
  while IFS= read -r f; do
    [ -z "$f" ] && continue
    [ -f "$f" ] || continue
    if ! node --check "$f" >/dev/null 2>&1; then
      failed="${failed}${f}"$'\n'
    fi
  done <<< "$staged_js"
fi

if [ -n "$staged_ts" ]; then
  tsc_bin=""
  if [ -x "./node_modules/.bin/tsc" ]; then
    tsc_bin="./node_modules/.bin/tsc"
  elif command -v tsc >/dev/null 2>&1; then
    tsc_bin="tsc"
  fi

  if [ -n "$tsc_bin" ]; then
    while IFS= read -r f; do
      [ -z "$f" ] && continue
      [ -f "$f" ] || continue
      # Filter to TS1xxx, TypeScript's syntactic diagnostic range. TS2xxx and
      # up are type errors, which need the whole project graph and are the
      # build's job, not this hook's.
      out="$("$tsc_bin" --noEmit --skipLibCheck --target es2022 \
        --moduleDetection force "$f" 2>&1 || true)"
      if printf '%s\n' "$out" | grep -qE 'error TS1[0-9]{3}:'; then
        failed="${failed}${f}"$'\n'
      fi
    done <<< "$staged_ts"
  fi
fi

if [ -n "$failed" ]; then
  printf 'pre-commit: syntax errors in staged files:\n\n%s\n' "$failed" >&2
  echo "Fix the parse errors above, then re-stage." >&2
  exit 1
fi

exit 0