#!/usr/bin/env bash
# Blocks two classes of mistake that cannot be undone after a public push:
# a commit authored under the wrong identity, and real personal data in the diff.
set -uo pipefail

ROOT="$(git rev-parse --show-toplevel)"

EXPECTED_EMAIL="egr.investor@gmail.com"
EXPECTED_NAME="Engineer Investor"

actual_email="$(git config user.email || true)"
actual_name="$(git config user.name || true)"

if [ "$actual_email" != "$EXPECTED_EMAIL" ] || [ "$actual_name" != "$EXPECTED_NAME" ]; then
  cat >&2 <<EOF
[identity] BLOCKED. This repo commits under a single identity.

  expected: $EXPECTED_NAME <$EXPECTED_EMAIL>
  actual:   ${actual_name:-<unset>} <${actual_email:-<unset>}>

The GitHub commit-author link is permanent and the address is exposed in the public
API, so this is fixed before the commit, not after. Run:

  git config user.name  "$EXPECTED_NAME"
  git config user.email "$EXPECTED_EMAIL"
EOF
  exit 1
fi

exec "$ROOT/scripts/pii_scan.sh"
