#!/usr/bin/env bash
# QualEdge Pre-Commit Hook Setup Script
# Installs git pre-commit hooks to enforce code quality and secret protection.

set -e

HOOKS_DIR=".git/hooks"
PRE_COMMIT_FILE="$HOOKS_DIR/pre-commit"

if [ ! -d ".git" ]; then
    echo "[ERROR] .git directory not found. Run this script from the workspace root."
    exit 1
fi

echo "[QualEdge] Installing enterprise Git pre-commit hooks..."

cat << 'EOF' > "$PRE_COMMIT_FILE"
#!/usr/bin/env bash
# Pre-commit hook checking for hardcoded secrets and syntax errors

echo "[Pre-Commit] Checking for accidental secret exposure..."

# Regex patterns for API keys
SECRET_PATTERNS=(
    "QAI_HUB_API_TOKEN=[a-zA-Z0-9_-]{20,}"
    "GROQ_API_KEY=gsk_[a-zA-Z0-9_-]{20,}"
    "sk-proj-[a-zA-Z0-9_-]{20,}"
)

FORBIDDEN_FOUND=0
for pattern in "${SECRET_PATTERNS[@]}"; do
    if git diff --cached | grep -E "$pattern" > /dev/null 2>&1; then
        echo "[ERROR] Hardcoded secret pattern detected in staged files: $pattern"
        FORBIDDEN_FOUND=1
    fi
done

if [ $FORBIDDEN_FOUND -eq 1 ]; then
    echo "[ABORT] Commit rejected due to hardcoded secrets. Use environment variables or .env placeholders."
    exit 1
fi

echo "[Pre-Commit] Secret scan passed. Executing pytest suite..."
PYTHONPATH=. pytest tests/ -q --tb=line

echo "[Pre-Commit] All checks passed successfully!"
exit 0
EOF

chmod +x "$PRE_COMMIT_FILE"
echo "[QualEdge] Pre-commit hook installed successfully at $PRE_COMMIT_FILE!"