#!/usr/bin/env node
/**
 * ─────────────────────────────────────────────
 *  SPB Drive — Personal Cloud Drive
 * ─────────────────────────────────────────────
 *  Author  : Simon-Pierre Boucher
 *  Contact : contact@spboucher.ai
 *  File    : scripts/check-secrets.mjs
 *  Purpose : CI gate — fail if any forbidden secret literal appears in the repo
 *  License : MIT © Simon-Pierre Boucher
 * ─────────────────────────────────────────────
 */

import { execSync } from 'node:child_process';
import { readFileSync } from 'node:fs';

// Forbidden literals are stored base64-encoded so this checker never
// contains the plaintext it is guarding against.
const FORBIDDEN = ['c24xOGJyYWR5'].map((b64) => Buffer.from(b64, 'base64').toString('utf8'));

const files = execSync('git ls-files', { encoding: 'utf8' }).split('\n').filter(Boolean);
const hits = [];

for (const file of files) {
  let buf;
  try { buf = readFileSync(file); } catch { continue; }
  const text = buf.toString('utf8');
  for (const secret of FORBIDDEN) {
    if (text.includes(secret)) hits.push(file);
  }
}

if (hits.length > 0) {
  console.error('✗ Forbidden secret literal found in:');
  for (const file of hits) console.error(`  ${file}`);
  process.exit(1);
}
console.log('✓ check:secrets — no forbidden literals in tracked files.');