#!/bin/sh

# ============================================================================
# SRG Pre-commit Hook
# ============================================================================
# Runs checks before each commit to catch issues early:
#   1. TypeScript type checking (project-wide)
#   2. lint-staged (ESLint on staged .ts files)
#   3. Sensitive data detection
#   4. Test compilation
# ============================================================================

echo "🔍 Running pre-commit checks..."
echo ""

# ── 0. Sync package-lock.json version ─────────────────────────────
# Automatically update package-lock.json if package.json version changed,
# so the lockfile version never drifts out of sync.
PKG_VER=$(node -p "require('./package.json').version" 2>/dev/null)
LOCK_VER=$(node -p "require('./package-lock.json').version" 2>/dev/null)
if [ -n "$PKG_VER" ] && [ "$PKG_VER" != "$LOCK_VER" ]; then
    echo "▸ Syncing package-lock.json version ($LOCK_VER → $PKG_VER)..."
    npm install --package-lock-only --silent 2>/dev/null
    git add package-lock.json
    echo "  ✓ package-lock.json synced"
fi

# ── 1. TypeScript type check ───────────────────────────────────────
echo "▸ TypeScript type check..."
npm run check-types --silent 2>/dev/null
if [ $? -ne 0 ]; then
    echo "❌ TypeScript type check failed. Fix type errors before committing."
    exit 1
fi
echo "  ✓ Types OK"

# ── 2. Test compilation ───────────────────────────────────────────
echo "▸ Compiling tests..."
npm run compile-tests --silent 2>/dev/null
if [ $? -ne 0 ]; then
    echo "❌ Test compilation failed. Fix errors before committing."
    exit 1
fi
echo "  ✓ Tests compile"

# ── 3. lint-staged (ESLint on staged files) ───────────────────────
echo "▸ Linting staged files..."
npx lint-staged
if [ $? -ne 0 ]; then
    echo "❌ Lint errors found. Please fix the above errors before committing."
    exit 1
fi

# ── 4. Sensitive data check ──────────────────────────────────────
echo "▸ Checking for sensitive data..."
STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
SENSITIVE_PATTERNS='(password|secret|token|api_key|private_key)\s*[:=]\s*["\x27][^"\x27]+'

if echo "$STAGED_FILES" | xargs grep -lPi "$SENSITIVE_PATTERNS" 2>/dev/null | grep -v node_modules | grep -v package-lock; then
    echo "⚠️  Potential sensitive data detected in staged files (review above)"
    echo "   If intentional (e.g., variable names), ignore this warning."
fi

# ── 5. Large file check ─────────────────────────────────────────
echo "▸ Checking file sizes..."
MAX_SIZE_KB=500
LARGE_FILES=""
for file in $STAGED_FILES; do
    if [ -f "$file" ]; then
        size_kb=$(du -k "$file" 2>/dev/null | cut -f1)
        if [ "$size_kb" -gt "$MAX_SIZE_KB" ] 2>/dev/null; then
            LARGE_FILES="$LARGE_FILES\n  $file (${size_kb}KB)"
        fi
    fi
done
if [ -n "$LARGE_FILES" ]; then
    echo "⚠️  Large files detected (>${MAX_SIZE_KB}KB):$LARGE_FILES"
    echo "   Consider adding to .gitignore or using Git LFS."
fi

echo ""
echo "✅ Pre-commit checks passed"
