#!/usr/bin/env bash
set -euo pipefail

repo_root=$(cd "$(dirname "$0")/.." && pwd -P)
pattern='thtdwh_v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{43}'
scan_root=$repo_root

if [[ $# -ne 0 ]]; then
  [[ $# -eq 2 && $1 == --root && $2 == /* && -d $2 && ! -L $2 ]] || {
    printf '%s\n' 'dwh-auth credential literal scan failed (invalid root)' >&2
    exit 2
  }
  scan_root=$(cd "$2" && pwd -P)
fi

set +e
rg --quiet --hidden --glob '!.git/**' -P -- "$pattern" "$scan_root"
scan_status=$?
set -e

case "$scan_status" in
  0)
    printf '%s\n' 'dwh-auth credential literal scan failed' >&2
    exit 1
    ;;
  1)
    printf '%s\n' 'dwh-auth credential literal scan passed'
    ;;
  *)
    printf '%s\n' "dwh-auth credential literal scan failed (rg status $scan_status)" >&2
    exit "$scan_status"
    ;;
esac