#!/bin/sh
# Block accidental commits of .env files, private keys, API tokens, or 16-digit card numbers.

set -e

if git diff --cached --name-only | grep -Eq '(^|/)(\.env(\.|$)|.*\.pem$|.*\.key$|cards\.local\.md$)'; then
  echo "pre-commit: blocked sensitive filename (.env / .pem / .key / cards.local.md)" >&2
  exit 1
fi

ADDED=$(git diff --cached -U0 | grep '^+' | grep -v '^+++' || true)

if printf '%s\n' "$ADDED" | grep -Eq '(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{30,}|AKIA[0-9A-Z]{16}|-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----)'; then
  echo "pre-commit: blocked staged secret/API key pattern" >&2
  exit 1
fi

if printf '%s\n' "$ADDED" | grep -Eq '(^|[^0-9])[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}[ -]?[0-9]{4}([^0-9]|$)'; then
  echo "pre-commit: blocked staged 16-digit payment-card-like sequence" >&2
  exit 1
fi
