import fs from 'fs';
import path from 'path';

const SECRET_PATTERNS = [
  /eyJ[A-Za-z0-9_-]{20,}/,
  /sk-[A-Za-z0-9]{20,}/,
  /token\s*[:=]\s*["'][A-Za-z0-9]{20,}["']/,
];

const SCAN_DIRS = ['src', 'tests', 'dist', 'scripts'];
let found = false;

function scanFile(filePath) {
  const content = fs.readFileSync(filePath, 'utf-8');
  for (const pattern of SECRET_PATTERNS) {
    const matches = content.match(pattern);
    if (matches) {
      console.log(`POTENTIAL SECRET: ${filePath}: ${matches[0].slice(0, 30)}...`);
      found = true;
    }
  }
}

function scanDir(dir) {
  if (!fs.existsSync(dir)) return;
  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
    const fullPath = path.join(dir, entry.name);
    if (entry.isDirectory()) {
      scanDir(fullPath);
    } else if (/\.(ts|js|json|html|css)$/.test(entry.name)) {
      scanFile(fullPath);
    }
  }
}

for (const dir of SCAN_DIRS) {
  scanDir(dir);
}

if (!found) {
  console.log('No secrets detected in source files.');
} else {
  process.exit(1);
}