#!/bin/bash
# Pre-commit hook adapted from GitHub workflow file-whitelist-check.yml
# Only checks the files being committed, not all files

# Load allowed file patterns from shared whitelist (single source of truth)
REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo ".")"
WHITELIST_FILE="$REPO_ROOT/.file-whitelist.txt"

if [ ! -f "$WHITELIST_FILE" ]; then
  echo "❌ Missing .file-whitelist.txt — cannot run whitelist check."
  exit 1
fi

ALLOWED_PATTERNS=()
while IFS= read -r line; do
  [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
  ALLOWED_PATTERNS+=("$line")
done < "$WHITELIST_FILE"

WHITELIST_VIOLATIONS=()
LARGE_FILES=()

echo "🔍 Running file whitelist security checks..."

# Process each file passed as argument
for file in "$@"; do
  # Skip if file doesn't exist (deleted files)
  if [ ! -f "$file" ]; then
    continue
  fi

  # 1. Whitelist check
  ALLOWED=false
  for pattern in "${ALLOWED_PATTERNS[@]}"; do
    if echo "$file" | grep -qE "$pattern"; then
      ALLOWED=true
      break
    fi
  done

  if [ "$ALLOWED" = "false" ]; then
    WHITELIST_VIOLATIONS+=("$file")
  fi

  # 2. Large file check (>1MB)
  FILE_SIZE=$(stat -c%s "$file" 2>/dev/null || stat -f%z "$file" 2>/dev/null || echo 0)
  if [ "$FILE_SIZE" -gt 1048576 ]; then
    LARGE_FILES+=("$file ($(echo "$FILE_SIZE" | awk '{printf "%.1fMB", $1/1024/1024}'))")
  fi
done

# Report violations
TOTAL_VIOLATIONS=0

if [ ${#WHITELIST_VIOLATIONS[@]} -gt 0 ]; then
  echo ""
  echo "❌ WHITELIST VIOLATIONS - File types not allowed in repository:"
  echo "   Binary files (images, audio, etc.) bloat the repo and should NOT be committed."
  echo "   Only explicitly listed binary files are allowed — store others externally."
  for violation in "${WHITELIST_VIOLATIONS[@]}"; do
    echo "  🚫 $violation"
  done
  TOTAL_VIOLATIONS=$((TOTAL_VIOLATIONS + ${#WHITELIST_VIOLATIONS[@]}))
fi

if [ ${#LARGE_FILES[@]} -gt 0 ]; then
  echo ""
  echo "❌ LARGE FILES (>1MB) - Files too big for repository:"
  for violation in "${LARGE_FILES[@]}"; do
    echo "  📏 $violation"
  done
  TOTAL_VIOLATIONS=$((TOTAL_VIOLATIONS + ${#LARGE_FILES[@]}))
fi

if [ $TOTAL_VIOLATIONS -eq 0 ]; then
  echo "✅ All file whitelist checks passed!"
  exit 0
else
  echo ""
  echo "💡 To fix these issues:"
  echo "   - For text/config files: add pattern to .file-whitelist.txt (requires maintainer approval)"
  echo "   - For binary files: do NOT add to the repo — they permanently bloat git history"
  echo "   - For large files: use external storage"
  echo ""
  exit 1
fi
