#!/usr/bin/env bash
# Build-time security scan of dist/ (§8 evidence). Fails the build if it finds:
#   - secrets / private keys / tokens
#   - inline <script> blocks (we require strict CSP script-src 'self')
#   - third-party script/style/font origins (everything must be self-hosted)
# Run after `astro build`. Exit non-zero on any finding.
set -euo pipefail

DIST="${1:-dist}"
fail=0

note() { printf '  %s\n' "$1"; }
bad() { printf '  ✗ %s\n' "$1"; fail=1; }

echo "== secret scan =="
# Allow our own public email + domains; look for genuinely secret-looking patterns.
if grep -rniE 'BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY|aws_secret|api[_-]?key["'"'"' :=]|secret[_-]?key["'"'"' :=]|password["'"'"' :=]|bearer [a-z0-9._-]{20}' "$DIST" 2>/dev/null; then
  bad "possible secret found in dist/"
else
  note "✓ no secret-like strings"
fi

echo "== inline <script> (must be none; CSP script-src 'self') =="
# An inline script is <script> WITHOUT a src= attribute.
if grep -rnoE '<script(>| [^>]*>)' "$DIST" --include='*.html' | grep -vE 'src=' >/dev/null; then
  grep -rnoE '<script(>| [^>]*>)' "$DIST" --include='*.html' | grep -vE 'src=' | head
  bad "inline <script> present"
else
  note "✓ no inline scripts"
fi

echo "== third-party resource origins (must be self-hosted) =="
# Flag <script src> / <link href> tags pointing off-domain (anchor <a href> links
# in the body are fine). Match the tag + attr together so e.g. linkedin.com in an
# <a> isn't a false positive.
if grep -rioE '<(script|link)\b[^>]*\b(src|href)="https?://[^"]+"' "$DIST" --include='*.html' \
    | grep -ivE '"https?://(www\.|git\.)?bztmon\.com' >/dev/null 2>&1; then
  echo "    offending tags:"
  grep -rioE '<(script|link)\b[^>]*\b(src|href)="https?://[^"]+"' "$DIST" --include='*.html' \
    | grep -ivE '"https?://(www\.|git\.)?bztmon\.com' | head
  bad "third-party script/style origin referenced"
else
  note "✓ no third-party script/style origins (external links in body are fine)"
fi

echo
if [[ "$fail" -ne 0 ]]; then
  echo "BUILD SCAN: FAIL"
  exit 1
fi
echo "BUILD SCAN: PASS"