#!/usr/bin/env bash
set -euo pipefail

RUN_ID="${PENTEST_RUN_ID:-manual}"
ARTIFACT_DIR="${PENTEST_ARTIFACT_DIR:-.paqad/pentest/runs/${RUN_ID}/artifacts}"
SECRET_DIR="${ARTIFACT_DIR}/secrets"
mkdir -p "${SECRET_DIR}"

if command -v git >/dev/null 2>&1; then
  FILES="$(git ls-files)"
else
  FILES="$(find . -type f \
    ! -path './node_modules/*' \
    ! -path './vendor/*' \
    ! -path './dist/*' \
    ! -path './coverage/*')"
fi

if command -v rg >/dev/null 2>&1; then
  printf '%s\n' "${FILES}" | while read -r file; do
    [ -z "${file}" ] && continue
    [ ! -f "${file}" ] && continue
    rg -n -H --no-heading \
      '(BEGIN (RSA|EC|OPENSSH|DSA) PRIVATE KEY|AWS_SECRET_ACCESS_KEY|api[_-]?key|secret[_-]?key|token=|password=)' \
      "${file}" >> "${SECRET_DIR}/matches.txt" || true
  done
else
  printf '%s\n' "${FILES}" | while read -r file; do
    [ -z "${file}" ] && continue
    [ ! -f "${file}" ] && continue
    grep -nE \
      '(BEGIN (RSA|EC|OPENSSH|DSA) PRIVATE KEY|AWS_SECRET_ACCESS_KEY|api[_-]?key|secret[_-]?key|token=|password=)' \
      "${file}" >> "${SECRET_DIR}/matches.txt" || true
  done
fi

touch "${SECRET_DIR}/matches.txt"
echo "secret scan complete"