#!/bin/bash
# Repository dispatcher: block direct/stale mainline work, then preserve the
# maintainer's shared PII guard when installed. Contributors without that shared
# guard still receive the local fallback scan below.

set -euo pipefail

REPO_ROOT="$(git rev-parse --show-toplevel)"
HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
cd "$REPO_ROOT"

node "$REPO_ROOT/scripts/git-mainline-guard.mjs" pre-commit

GLOBAL_GUARD_DIR="${GIT_PII_GUARD_DIR:-${HOME:-}/scripts/git-pii-guard}"
if [ -x "$GLOBAL_GUARD_DIR/pre-commit" ]; then
  GLOBAL_HOOK_DIR="$(cd "$(dirname "$GLOBAL_GUARD_DIR/pre-commit")" && pwd)"
  if [ "$GLOBAL_HOOK_DIR" != "$HOOK_DIR" ]; then
    exec "$GLOBAL_GUARD_DIR/pre-commit"
  fi
fi

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "🔍 Scanning staged changes for sensitive data..."

FAILED=0

# Layer 1: gitleaks (if available)
if command -v gitleaks &>/dev/null; then
  if ! gitleaks protect --staged --config .gitleaks.toml --no-banner 2>/dev/null; then
    echo -e "${RED}❌ gitleaks found secrets in staged changes${NC}"
    FAILED=1
  fi
else
  echo -e "${YELLOW}⚠ gitleaks not installed (brew install gitleaks), falling back to pattern scan${NC}"
fi

# Layer 2: fast regex scan (always runs, catches what gitleaks config might miss)
STAGED_DIFF=$(git diff --cached --diff-filter=ACDMR)

PATTERNS=(
  '/Users/[a-zA-Z][a-zA-Z0-9_-]+/'
  '/home/[a-zA-Z][a-zA-Z0-9_-]+/'
  'C:\\Users\\[a-zA-Z]'
  '1[3-9][0-9]{9}'
)

for pattern in "${PATTERNS[@]}"; do
  MATCHES=$(echo "$STAGED_DIFF" | grep -nE "^\+" | grep -E "$pattern" | grep -v "^+++\|\.gitleaks\.toml\|\.githooks/\|\.gitignore\|placeholder\|example\|CLAUDE\.md" || true)
  if [ -n "$MATCHES" ]; then
    echo -e "${RED}❌ Found sensitive pattern '${pattern}':${NC}"
    echo "$MATCHES" | head -5
    FAILED=1
  fi
done

if [ $FAILED -eq 1 ]; then
  echo ""
  echo -e "${RED}Commit blocked. Fix the issues above, or use --no-verify to bypass (not recommended).${NC}"
  exit 1
fi

echo -e "${GREEN}✅ No sensitive data found in staged changes.${NC}"
