#!/usr/bin/env bash
# 扫描交付目录中的高风险密钥/直连痕迹（实例内执行）
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"

echo "== TARGET-voc-instance secret scan =="
echo "root: $ROOT"

PATTERNS=(
  'TIKHUB_TOKEN'
  'TIKHUB_PROXY_URL'
  'server-msq\.fmode\.cn'
  'standardapi\.sorftime\.com'
  'api\.tikhub\.io'
  'server\.fmode\.cn/thapi'
  'BasicAuth [A-Za-z0-9]'
  'Bearer r[A-Za-z0-9]'
  'r:d5d356'
  'postgresql://root:'
  'Msq2025uqisad'
  'msq!post666'
)

FAIL=0
for p in "${PATTERNS[@]}"; do
  echo "--- pattern: $p"
  RG_EXCLUDES=(
    -g '!node_modules'
    -g '!dist'
    -g '!*.lock'
    -g '!docs/**'
    -g '!**/docs/**'
    -g '!scripts/scan-secrets.sh'
    -g '!scripts/desense.ps1'
    -g '!**/README.md'
    -g '!**/CHANGELOG.md'
  )
  if command -v rg >/dev/null 2>&1; then
    if rg -n --hidden "${RG_EXCLUDES[@]}" "$p" frontend/src backend/api backend/src backend/config.json backend/config.example.json backend/server.ts frontend/src/assets ; then
      echo "FOUND: $p"
      FAIL=1
    else
      echo "clean (runtime paths)"
    fi
  else
    if grep -RIn --exclude-dir=node_modules --exclude-dir=dist --exclude='*.lock' -E "$p" frontend/src backend/api backend/src backend/config.json backend/server.ts ; then
      echo "FOUND: $p"
      FAIL=1
    else
      echo "clean (runtime paths)"
    fi
  fi
done

# sk 占位允许存在，真实 sk 不允许（仅运行时路径）
echo "--- pattern: live sk- (non-placeholder)"
if command -v rg >/dev/null 2>&1; then
  if rg -n -g '!node_modules' -g '!dist' "sk-[A-Za-z0-9]" frontend/src backend/api backend/src backend/config.json backend/config.example.json | rg -v 'sk-TARGET_RELAY_SK' ; then
    echo "FOUND live sk"
    FAIL=1
  else
    echo "clean (only placeholder or none)"
  fi
fi

if [ "$FAIL" -ne 0 ]; then
  echo "SCAN_FAILED"
  exit 1
fi
echo "SCAN_OK"