#!/usr/bin/env bash
set -euo pipefail

mode="${1:---staged}"
secret_pattern='(sk-(ws[-_]?)?[A-Za-z0-9_-]{24,}|llm-[a-z0-9]{12,}|AKIA[0-9A-Z]{16}|-----BEGIN ([A-Z0-9 ]+ )?PRIVATE KEY-----)'
found=0

check_file() {
  local file="$1"
  if [[ -f "$file" ]] && grep -I -q -E "$secret_pattern" "$file"; then
    printf 'Potential secret detected in: %s\n' "$file" >&2
    found=1
  fi
}

check_staged_file() {
  local file="$1"
  if git cat-file -e ":$file" 2>/dev/null \
    && grep -I -q -E "$secret_pattern" < <(git show ":$file"); then
    printf 'Potential secret detected in staged content: %s\n' "$file" >&2
    found=1
  fi
}

case "$mode" in
  --staged)
    while IFS= read -r -d '' file; do
      check_staged_file "$file"
    done < <(git diff --cached --name-only --diff-filter=ACMR -z)
    ;;
  --all)
    while IFS= read -r -d '' file; do
      check_file "$file"
    done < <(git ls-files --cached --others --exclude-standard -z)
    ;;
  *)
    printf 'Usage: %s [--staged|--all]\n' "$0" >&2
    exit 2
    ;;
esac

if [[ "$found" -ne 0 ]]; then
  printf 'Commit blocked. Rotate any exposed credential before continuing.\n' >&2
  exit 1
fi

printf 'Secret scan passed.\n'