#!/usr/bin/env bash
set -uo pipefail

# CASAN WP-S4 — Secrets lifecycle check.
# Verifies:
#   1. .env files are NOT in the git index (committed).
#   2. No real private keys appear in tracked files (test fixtures accepted with override).
#   3. No API key patterns in audit/log files.
#   4. .gitignore covers .env and key file extensions.
#
# Honest scope: this scans the local checkout and git index. It does NOT
# scan git history (past commits). Historical leak scanning requires
# git-secrets or similar tooling noted as a production recommendation.
#
# Exit: 0 all checks pass, 1 violation found, 2 scan error.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/casan-paths.sh"
ROOT="$CASAN_APP_ROOT"
PASS=0; FAIL=0; WARN=0

ok()   { echo "  PASS  $1"; PASS=$((PASS+1)); }
fail() { echo "  FAIL  $1"; FAIL=$((FAIL+1)); }
warn() { echo "  WARN  $1"; WARN=$((WARN+1)); }

echo "=== CASAN WP-S4: Secrets lifecycle scan ==="

cd "$ROOT"

# ── 1. No .env committed to git index ──────────────────────────────────────
committed_envs="$(git ls-files | grep -E '(^|/)\.env(\.|$)' 2>/dev/null || true)"
if [[ -z "$committed_envs" ]]; then
  ok ".env files NOT in git index"
else
  fail ".env files committed to git: $committed_envs"
fi

# ── 2. No real private keys in tracked files ───────────────────────────────
# Exclude known test-fixture files and evidence directories that intentionally
# contain the pattern as test data.
FIXTURE_EXCLUDES=(
  ".specify/tests/"
  "docs/output/casan/evidence/"
  ".specify/security/"
  ".specify/scripts/bash/security-check.sh"
  ".specify/scripts/bash/verify-audit-chain.sh"
  ".specify/scripts/bash/verify-tool-audit.sh"
  ".specify/scripts/bash/tool-audit-lib.sh"
  ".specify/scripts/bash/governance-check.sh"
)
build_exclude_args() {
  for ex in "${FIXTURE_EXCLUDES[@]}"; do printf -- "--exclude-dir=%s " "$ex"; done
}

# Look for actual private key headers — presence in test grep-pattern code is OK,
# but a real PEM block would have the header on its own line.
real_key_hits="$(git ls-files | xargs grep -l -- "^-----BEGIN.*PRIVATE KEY-----" 2>/dev/null | \
  grep -vE "(tests|evidence|security/|security-check|verify-audit|tool-audit-lib|governance-check)" || true)"
if [[ -z "$real_key_hits" ]]; then
  ok "No real private key PEM headers in tracked files"
else
  fail "Private key PEM headers found in tracked files: $real_key_hits"
fi

# ── 3. Audit PRIVATE key is NOT in the git index ───────────────────────────
# PUBLIC keys (*-public.pem, policy-public.pem) are intentionally committed
# for audit chain verification — that is correct design.
# PRIVATE keys (*-private.pem, *-private.key, id_rsa, id_ed25519) must NEVER
# be in the repo; the signing key lives at ~/.casan/audit-keys/ off-repo.
repo_private_keys="$(git ls-files | grep -E '(private\.(pem|key)|id_rsa|id_ed25519|\.p12|\.pfx)$' 2>/dev/null || true)"
if [[ -z "$repo_private_keys" ]]; then
  ok "No private key files in git index (public keys are allowed and expected)"
else
  fail "Private key files in git index: $repo_private_keys"
fi

# ── 4. .gitignore covers .env and key extensions ───────────────────────────
gitignore="$ROOT/.gitignore"
missing_patterns=()
for pat in ".env" "*.pem" "*.key"; do
  if ! grep -qF "$pat" "$gitignore" 2>/dev/null; then
    missing_patterns+=("$pat")
  fi
done
if [[ ${#missing_patterns[@]} -eq 0 ]]; then
  ok ".gitignore covers .env and key extensions"
else
  fail ".gitignore missing: ${missing_patterns[*]}"
fi

# ── 5. No API key patterns in log/audit files ──────────────────────────────
LOG_DIRS=(
  ".specify/logs/audit"
  ".specify/logs/level5"
  ".specify/agentops"
)
API_KEY_REGEX='(sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36})'
key_in_logs=""
for dir in "${LOG_DIRS[@]}"; do
  if [[ -d "$ROOT/$dir" ]]; then
    hit="$(grep -rlE "$API_KEY_REGEX" "$ROOT/$dir" 2>/dev/null || true)"
    [[ -n "$hit" ]] && key_in_logs="$key_in_logs $hit"
  fi
done
if [[ -z "$key_in_logs" ]]; then
  ok "No API key patterns in audit/log files"
else
  fail "API key pattern found in logs:$key_in_logs"
fi

# ── 6. No ANTHROPIC_API_KEY or OPENAI_API_KEY in any tracked file ──────────
key_in_code="$(git ls-files | xargs grep -l \
  'ANTHROPIC_API_KEY[[:space:]]*=[[:space:]]*[^$"'"'"'({][^[:space:]]' \
  2>/dev/null | grep -v '.env.example' || true)"
if [[ -z "$key_in_code" ]]; then
  ok "No hardcoded API key assignments in tracked code"
else
  warn "Possible hardcoded API key in: $key_in_code (verify manually)"
fi

echo ""
echo "=== Secrets scan: PASS=$PASS FAIL=$FAIL WARN=$WARN ==="
echo "NOTE: historical leak scan (git history) requires git-secrets — run separately in CI."
[[ "$FAIL" -eq 0 ]] || exit 1