#!/usr/bin/env bash
set -euo pipefail

ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)
cd "$ROOT"
mapfile -d '' -t TRACKED < <(git ls-files -z --cached --others --exclude-standard -- ':!docs/superpowers/**' ':!foundry.lock' ':!package-lock.json' ':!web/package-lock.json')

secret_names='PRIVATE''_KEY|MNEM''ONIC'
assignment_pattern="(^|[^[:alnum:]_])(${secret_names})[[:space:]]*="
pem_pattern='-----BEGIN .*PRI''VATE KEY-----'
unfinished_pattern='(^|[^[:alnum:]_])(TO''DO|T''BD|FIX''ME)([^[:alnum:]_]|$)'
filler_pattern='lorem[[:space:]]+ip''sum|fill''er[[:space:]]+text'
unsafe_pattern='unsafe''Allow|unsafe''SkipStorageCheck|unsafe''SkipAllChecks|oz-upgrades-unsafe-allow'
allowed_annotation='    /// @custom:oz-upgrades-unsafe-allow constructor'
fixture_name='ANVIL_''TEST_PHRASE'
allowed_fixture_path='script/lib/DemoScript.sol'
allowed_fixture_line='    string internal constant ANVIL_''TEST_PHRASE = "test test test test test test test test test test test junk";'
fixture_count=0
violations=0

report_matches() {
  local path=$1 pattern=$2 label=$3 line number=0
  while IFS= read -r line || [[ -n "$line" ]]; do
    number=$((number + 1))
    if [[ "$line" =~ $pattern ]]; then
      printf 'forbidden %s: %s:%d:%s\n' "$label" "$path" "$number" "$line" >&2
      violations=$((violations + 1))
    fi
  done <"$path"
}

for path in "${TRACKED[@]}"; do
  [[ "$path" == lib/* || ! -f "$path" ]] && continue
  report_matches "$path" "$assignment_pattern" 'secret assignment'
  report_matches "$path" "$pem_pattern" 'PEM private key'
  report_matches "$path" "$unfinished_pattern" 'unfinished marker'
  report_matches "$path" "$filler_pattern" 'filler content'
  while IFS= read -r line || [[ -n "$line" ]]; do
    if [[ "$line" == *"$fixture_name"*'='* ]]; then
      if [[ "$path" == "$allowed_fixture_path" && "$line" == "$allowed_fixture_line" ]]; then
        fixture_count=$((fixture_count + 1))
      else
        printf 'forbidden local phrase assignment outside exact fixture: %s:%s\n' "$path" "$line" >&2
        violations=$((violations + 1))
      fi
    fi
  done <"$path"
  if [[ "$path" == src/* || "$path" == test/* || "$path" == script/* ]]; then
    while IFS= read -r line || [[ -n "$line" ]]; do
      if [[ "$line" =~ $unsafe_pattern && "$path:$line" != "src/BankV1.sol:$allowed_annotation" ]]; then
        printf 'forbidden unsafe upgrade bypass: %s:%s\n' "$path" "$line" >&2
        violations=$((violations + 1))
      fi
    done <"$path"
  fi
done

if ((fixture_count != 1)); then
  printf 'expected exactly one local phrase fixture assignment, found %d\n' "$fixture_count" >&2
  violations=$((violations + 1))
fi

((violations == 0)) || { printf 'Project scan failed with %d violation(s).\n' "$violations" >&2; exit 1; }
printf 'Project scan passed across %d tracked paths.\n' "${#TRACKED[@]}"