#!/bin/sh
# jobhunt pre-commit: refuse secrets and personal data.
#
# Set up via repo-local `core.hooksPath=.githooks`, because this machine has a
# machine-wide core.hooksPath (C:/ProgramData/GitHooks) which makes .git/hooks
# inert. The corporate hook is CHAINED below rather than replaced -- it stays
# authoritative, and these checks are additive.
#
# Why these checks are needed even with the corporate hook present: that hook
# exits 0 immediately for a repo with no remote.origin.url, so its gitleaks scan
# never runs here. This repo is local-only by design, so it gets no scan at all.

CORP="C:/ProgramData/GitHooks/pre-commit"
if [ -x "$CORP" ]; then "$CORP" "$@" || exit 1; fi

fail=0
staged=$(git diff --cached --name-only --diff-filter=ACM)
for f in $staged; do
  case "$f" in
    .env.example) : ;;
    .env|.env.*|*/.env)
      echo "REFUSED: $f is staged - it holds secrets." >&2; fail=1 ;;
    data/*)
      echo "REFUSED: $f is staged. data/ holds your resume, expected CTC and visa" >&2
      echo "         status. It is gitignored on purpose; data.example/ is the" >&2
      echo "         committed placeholder equivalent." >&2
      fail=1 ;;
    out/*)
      echo "REFUSED: $f is staged - out/ holds generated applications." >&2; fail=1 ;;
  esac
done

added=$(git diff --cached --diff-filter=ACM -U0 | grep '^+' | grep -v '^+++')
check() {
  # -- is required: a pattern starting with "-" is otherwise read as a flag,
  # which made the private-key check error out instead of ever matching.
  if printf '%s' "$added" | grep -Eq -- "$1"; then
    echo "REFUSED: staged content looks like $2" >&2; fail=1
  fi
}
check 'AIza[0-9A-Za-z_-]{30,}'            "a Google API key"
check 'AQ\.[A-Za-z0-9_-]{25,}'            "a Google OAuth credential"
check 'sk-ant-[A-Za-z0-9_-]{20,}'         "an Anthropic API key"
check 'sk-[A-Za-z0-9]{32,}'               "an OpenAI API key"
check 'gsk_[A-Za-z0-9]{30,}'              "a Groq API key"
check '(ghp|gho|ghs)_[A-Za-z0-9]{30,}'    "a GitHub token"
check 'github_pat_[A-Za-z0-9_]{30,}'      "a GitHub fine-grained PAT"
check 'AKIA[0-9A-Z]{16}'                  "an AWS access key id"
check '-----BEGIN [A-Z ]*PRIVATE KEY-----' "a private key"

if [ "$fail" -ne 0 ]; then
  echo "" >&2
  echo "Nothing committed. Unstage it, or use --no-verify deliberately." >&2
  exit 1
fi
exit 0
