#!/bin/sh
set -eu

# Validate arguments
if [ $# -eq 1 ] && { [ "$1" = "--changed" ] || [ "$1" = "--staged" ]; }; then
  mode="$1"
  revision_range=""
elif [ $# -eq 2 ] && [ "$1" = "--range" ]; then
  mode="$1"
  revision_range="$2"
else
  exit 2
fi

failed=0

# Get the list of paths based on mode
if [ "$mode" = "--staged" ]; then
  paths=$(git diff --cached --name-only 2>/dev/null || true)
elif [ "$mode" = "--range" ]; then
  paths=$(git diff --name-only "$revision_range" 2>/dev/null) || {
    printf 'cannot inspect protected paths in range: %s\n' "$revision_range" >&2
    exit 1
  }
else
  paths=$( { git diff --name-only 2>/dev/null; git ls-files --others --exclude-standard 2>/dev/null; } || true)
fi

# Check each path
while IFS= read -r path; do
  [ -z "$path" ] && continue

  case "$path" in
    config/local.toml|workspace/*|sets/*|*.sqlite*)
      printf 'protected local path: %s\n' "$path" >&2
      failed=1
      ;;
    .specifications/*)
      printf 'protected specification archive path: %s\n' "$path" >&2
      failed=1
      ;;
  esac
done <<EOF
$paths
EOF

exit "$failed"
