#!/usr/bin/env bash
# Lightweight fail-closed scan for the checked-out source tree. Historical Git
# secrets are deliberately not rewritten here; this gate prevents new obvious
# plaintext credentials from entering the current product tree.
set -euo pipefail

if ! command -v rg >/dev/null 2>&1; then
  echo 'rg is required for the repository secret scan.' >&2
  exit 69
fi

# Only configuration and executable wiring can introduce a usable credential.
# Application code contains benign variables such as `rawPassword`; scanning it
# creates noise and makes a security gate easy to ignore.
scan_args=(--hidden --pcre2 --glob '!.git/**' --glob '!client/node_modules/**' --glob '!server/target/**' --glob '!client/dist/**' --glob '*.yml' --glob '*.yaml' --glob '*.properties' --glob '.env' --glob '.env.*' --glob '*.sh')

# Ignore environment placeholders and explicitly fake examples. Reject literal
# values of at least 12 characters, which includes all deployable credentials.
credential_pattern='(?i)(?<![A-Za-z0-9_])(password|passwd|secret|api[_-]?key|access[_-]?key)[[:space:]]*[:=][[:space:]]*["\x27]?(?!\$\{|<|your-|[A-Za-z0-9._-]*xxx)[A-Za-z0-9][A-Za-z0-9_+/.=-]{11,}'
credential_matches="$(rg -n -I "${scan_args[@]}" "${credential_pattern}" . || true)"
if [[ -n "${credential_matches}" ]]; then
  echo 'Potential plaintext credential(s) detected outside tests:' >&2
  printf '%s\n' "${credential_matches}" >&2
  exit 73
fi

jdbc_userinfo_matches="$(rg -n -I "${scan_args[@]}" 'jdbc:(mysql|postgresql):[^[:space:]]*//[^[:space:]@/]+:[^[:space:]@/]+@' . || true)"
if [[ -n "${jdbc_userinfo_matches}" ]]; then
  echo 'JDBC URL with embedded user information detected:' >&2
  printf '%s\n' "${jdbc_userinfo_matches}" >&2
  exit 74
fi

for config_file in server/src/main/resources/application-dev.yml server/src/main/resources/application-prod.yml; do
  if [[ ! -f "${config_file}" ]]; then
    continue
  fi
  if rg --pcre2 -n '^\s*(url|username|password):\s*(?!\$\{)[^#\s].*$' "${config_file}" >/dev/null; then
    echo "${config_file} contains a non-environment datasource value." >&2
    exit 75
  fi
done

echo 'Repository plaintext-secret scan passed.'