#!/usr/bin/env bash
set -euo pipefail

repository_directory=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
cd "$repository_directory"
mapfile -t files < <(git ls-files --cached --others --exclude-standard)

for file in "${files[@]}"; do
  case "$(basename "$file")" in
    auth.json|.credentials.yaml*|logins.json|key4.db|cookies.sqlite)
      printf 'Forbidden credential file found: %s\n' "$file" >&2
      exit 1
      ;;
  esac
done

if ((${#files[@]})) && grep -IE --binary-files=without-match '"(accessToken|refreshToken|idToken|apiKey|clientSecret)"[[:space:]]*:' "${files[@]}"; then
  printf 'Possible credential field found.\n' >&2
  exit 1
fi

if ((${#files[@]})) && grep -IE --binary-files=without-match '(ghp_[A-Za-z0-9]{30,}|sk-[A-Za-z0-9_-]{20,})' "${files[@]}"; then
  printf 'Possible token found.\n' >&2
  exit 1
fi

printf 'repository secret scan passed\n'