#!/usr/bin/env bash
#
# regista local identifier gate (project-initiation scaffold).
#
# Mirrors the CI `identifier-gate` job so a forbidden work-domain identifier is
# caught BEFORE it lands in a commit. The CI gate only runs after push, so by the
# time it flags a token it is already in history; this hook closes that window.
#
# Companion hooks (all installed together): `commit-msg` scans the commit message,
# `pre-push` checks publication plumbing and messages in the push range.
#
# Activate (once per clone):   scripts/install-git-hooks.sh
#
# The denylist is never committed — NAMING A FORBIDDEN IDENTIFIER IN A TRACKED
# FILE, INCLUDING IN A COMMENT LIKE THIS ONE, IS ITSELF THE LEAK. This comment
# once named the work domain as an illustrative example; the gate could not match
# it (multi-word entries were unrepresentable) and the copy of this scaffold in
# sixteen repositories, eight of them public, published it. Describe the denylist;
# never quote it.
#
# It is resolved, in order, from:
#   1. $REGISTA_FORBIDDEN_IDENTIFIERS            (already exported, e.g. CI)
#   2. <repo>/.identifiers-denylist.local            (gitignored, per-repo)
#   3. ~/.config/agent-suite/forbidden-identifiers   (shared canonical set)
#
# The shared canonical denylist holds work-domain identifiers only; homelab/lab
# identifiers are deliberately NOT in it — lab topology is allowed in public
# repos (docs/publication-review.md). Multi-word entries must be double-quoted.
set -euo pipefail

repo_root="$(git rev-parse --show-toplevel)"

if [ -z "${REGISTA_FORBIDDEN_IDENTIFIERS:-}" ]; then
  for candidate in \
    "$repo_root/.identifiers-denylist.local" \
    "${HOME:-}/.config/agent-suite/forbidden-identifiers"; do
    if [ -f "$candidate" ]; then
      REGISTA_FORBIDDEN_IDENTIFIERS="$(cat "$candidate")"
      export REGISTA_FORBIDDEN_IDENTIFIERS
      break
    fi
  done
fi

# No denylist: the gate decides from publication.toml. A repo declared PUBLIC is
# refused (exit 1); a private-until-review repo stays a no-op so a fresh clone is
# not bricked. The ONLY bypass is the explicit GATE_ALLOW_NO_DENYLIST=1, which
# prints a warning every time it is used.
no_denylist=0
denylist="${REGISTA_FORBIDDEN_IDENTIFIERS:-}"
if [ -z "${denylist//[[:space:]]/}" ]; then
  no_denylist=1
  if [ "${GATE_ALLOW_NO_DENYLIST:-}" = "1" ]; then
    echo "regista pre-commit: WARNING: identifier gate BYPASSED (GATE_ALLOW_NO_DENYLIST=1) -- no denylist, the staged content was NOT scanned." >&2
    exit 0
  fi
fi

python_bin="$repo_root/.venv/bin/python"
[ -x "$python_bin" ] || python_bin="$(command -v python3 || command -v python || true)"
if [ -z "$python_bin" ]; then
  echo "regista pre-commit: FATAL: no Python interpreter found; the identifier gate cannot run." >&2
  exit 1
fi

status=0
"$python_bin" "$repo_root/scripts/check_committed_identifiers.py" --staged || status=$?
if [ "$status" -ne 0 ] && [ "$no_denylist" -eq 1 ]; then
  echo "regista pre-commit: fix: put the denylist in ~/.config/agent-suite/forbidden-identifiers (or export REGISTA_FORBIDDEN_IDENTIFIERS); to bypass once, GATE_ALLOW_NO_DENYLIST=1 (warned)." >&2
fi
exit "$status"
