#!/usr/bin/env bash
set -euo pipefail

bundle="$1"

# Dereference symlinks so we scan the actual file tree.
# Assert at least one regular file exists to catch an empty/broken bundle.
file_count=$(find -L "$bundle" -type f | wc -l)
if [[ "$file_count" -eq 0 ]]; then
  echo "Production bundle appears empty — no regular files found under $bundle" >&2
  exit 1
fi

# ── No .env file (contains real AWS credentials in developer environment) ─────
if find -L "$bundle" -type f -name ".env" | grep -q .; then
  echo "Production bundle contains .env (credential file)" >&2
  exit 1
fi

# ── No .config file (contains real secrets in developer environment) ──────────
if find -L "$bundle" -type f -name ".config" | grep -q .; then
  echo "Production bundle contains .config (secret file)" >&2
  exit 1
fi

# ── No SQLite database, WAL, or SHM files ─────────────────────────────────────
if find -L "$bundle" -type f \( -name "*.db" -o -name "*.db-wal" -o -name "*.db-shm" \) | grep -q .; then
  echo "Production bundle contains a database or WAL/SHM file" >&2
  exit 1
fi

# ── No AUTH_COOKIE_SECRET values (non-hex-chars after = are false positive safe) ─
# Match a line that looks like AUTH_COOKIE_SECRET=<hex-looking value> (≥64 chars)
if grep -R -a -l -E 'AUTH_COOKIE_SECRET=[0-9a-fA-F]{64}' "$bundle"; then
  echo "Production bundle contains an AUTH_COOKIE_SECRET assignment with a secret value" >&2
  exit 1
fi

# ── No zenbu-scrypt hashes (bootstrap password hashes) ────────────────────────
# The literal prefix "zenbu-scrypt$" followed by a v= parameter is the real hash
# format; safe references are only in comments or test-fixture strings in binaries.
# We scan text files only (config, scripts, yaml) — not compiled binaries.
if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
    -exec grep -l 'zenbu-scrypt\$v=' {} \;  | grep -q .; then
  echo "Production bundle contains a zenbu-scrypt password hash in a config/script" >&2
  exit 1
fi

# ── No mjj_session or mjj_guest raw token values in config/scripts ─────────────
# Cookie *names* appear safely in source code; we check only config/script files.
if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
    -exec grep -lE 'mjj_session=[A-Za-z0-9_-]{20,}|mjj_guest=[A-Za-z0-9_-]{20,}' {} \; | grep -q .; then
  echo "Production bundle contains raw mjj_session/mjj_guest token values" >&2
  exit 1
fi