#!/usr/bin/env bash
# Quality gate -- see CLAUDE.md "Quality gate -- every commit" for what each step is and why.
# Activate once per clone with: git config core.hooksPath .githooks
set -euo pipefail
cd "$(git rev-parse --show-toplevel)"

fail() {
    echo "pre-commit: $1" >&2
    exit 1
}

echo "== [1/8] Build =="
./gradlew :app:compileDebugKotlin -q

echo "== [2/8] Tests =="
./gradlew :app:testDebugUnitTest -q

echo "== [3/8] Static analysis: lint =="
if ! ./gradlew :app:lintDebug -q; then
    fail "lint failed -- fix all lint ERRORS before committing (warnings are fine to accumulate, see CLAUDE.md)."
fi

echo "== [4/8] Static analysis: detekt (code-quality auditor) =="
if ! ./gradlew :app:detekt -q; then
    fail "detekt found new issues beyond the tracked baseline. Fix them, or if they're genuinely pre-existing debt being touched incidentally, regenerate the baseline with './gradlew :app:detektBaseline' and explain why in the commit message."
fi

echo "== [5/8] Coverage must not decrease =="
./gradlew :app:jacocoTestReport -q
REPORT="app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml"
BASELINE_FILE=".coverage-baseline"
if [ -f "$REPORT" ]; then
    CURRENT=$(python3 - "$REPORT" <<'PY'
import sys, xml.etree.ElementTree as ET
root = ET.parse(sys.argv[1]).getroot()
line = next(c for c in root.findall('counter') if c.get('type') == 'LINE')
missed, covered = int(line.get('missed')), int(line.get('covered'))
total = missed + covered
print(f"{(covered / total * 100) if total else 0.0:.2f}")
PY
)
else
    CURRENT="0.00"
fi
BASELINE=$(cat "$BASELINE_FILE" 2>/dev/null || echo "0.00")

DROPPED=$(python3 -c "print(1 if float('$CURRENT') < float('$BASELINE') else 0)")
if [ "$DROPPED" = "1" ]; then
    if [ -n "${COVERAGE_EXCEPTION:-}" ]; then
        echo "pre-commit: coverage dropped ${BASELINE}% -> ${CURRENT}% -- allowed via COVERAGE_EXCEPTION: ${COVERAGE_EXCEPTION}"
        echo "$CURRENT" > "$BASELINE_FILE"
        git add "$BASELINE_FILE"
    else
        fail "coverage dropped ${BASELINE}% -> ${CURRENT}%. If this drop is the correct outcome (e.g. deleting dead covered code), commit with COVERAGE_EXCEPTION=\"reason\" git commit ... Otherwise, add tests."
    fi
else
    echo "$CURRENT" > "$BASELINE_FILE"
    git add "$BASELINE_FILE"
    echo "pre-commit: coverage ${BASELINE}% -> ${CURRENT}%"
fi

echo "== [6/8] WebView JavaScript justification =="
STAGED_KT=$(git diff --cached --name-only --diff-filter=ACM -- '*.kt' || true)
if [ -n "$STAGED_KT" ]; then
    for f in $STAGED_KT; do
        [ -f "$f" ] || continue
        ADDED_JS_LINES=$(git diff --cached -U0 -- "$f" | grep -E '^\+.*(javaScriptEnabled\s*=\s*true|setJavaScriptEnabled\(true\))' || true)
        if [ -n "$ADDED_JS_LINES" ]; then
            if ! grep -q '@SuppressLint("SetJavaScriptEnabled")' "$f"; then
                fail "$f enables JavaScript on a WebView with no @SuppressLint(\"SetJavaScriptEnabled\") + justification comment nearby (see ReaderExtractor.kt, LinkReaderScreen.kt, BrowserScreen.kt for the pattern). This app's security posture depends on every JS-enabled site being deliberate and explained."
            fi
        fi
    done
fi

echo "== [7/8] Manifest permission diff =="
if git diff --cached --name-only | grep -q '^app/src/main/AndroidManifest.xml$'; then
    if git diff --cached -- app/src/main/AndroidManifest.xml | grep -qE '^\+.*<uses-permission'; then
        echo "pre-commit: WARNING -- AndroidManifest.xml adds a new <uses-permission>. Make sure the commit message says why."
    fi
fi

echo "== [8/8] Secret scan =="
if [ -z "${SECRET_SCAN_OVERRIDE:-}" ]; then
    SECRET_HIT=$(git diff --cached -U0 -- . ':!*.lock' | grep -E '^\+' | grep -viE '^\+\+\+' | grep -E '(api[_-]?key|secret|password|token)["'\'' ]*[:=]["'\'' ]*[A-Za-z0-9_\-]{16,}' || true)
    if [ -n "$SECRET_HIT" ]; then
        echo "$SECRET_HIT" >&2
        fail "possible hardcoded secret in the staged diff (see above). If this is a false positive (e.g. an obviously-fake test fixture key), commit with SECRET_SCAN_OVERRIDE=1 git commit ..."
    fi
else
    echo "pre-commit: secret scan skipped (SECRET_SCAN_OVERRIDE set)"
fi

echo "pre-commit: all checks passed."