pre-commit

#!/usr/bin/env bash
# Dialtone pre-commit hook - blocks commits containing secrets
set -euo pipefail

RED='\033[0;31m'
YELLOW='\033[1;33m'
GREEN='\033[0;32m'
NC='\033[0m'

STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || true)
[ -z "$STAGED_FILES" ] && exit 0

FOUND=0
REPORT=""

report() {
    FOUND=$((FOUND + 1))
    REPORT="${REPORT}\n  ${RED}x${NC} ${YELLOW}${2}${NC} in ${1}"
}

get_lines() {
    git diff --cached -U0 -- "$1" 2>/dev/null | grep -E '^\+' | grep -vF '+++'
}

scan() {
    local file="$1" pattern="$2" label="$3"
    local hits
    hits=$(get_lines "$file" | grep -Ein -- "$pattern" || true)
    [ -n "$hits" ] && report "$file" "$label"
}

echo -e "${GREEN}Pre-commit: scanning for secrets...${NC}\n"

for file in $STAGED_FILES; do
    [[ "$file" == *.png || "$file" == *.jpg || "$file" == *.mp3 || "$file" == *.mp4 ]] && continue
    [[ "$file" == "pre-commit" ]] && continue
    [ -f "$file" ] || continue

    # Twilio
    scan "$file" 'AC[a-f0-9]{32}' "Twilio Account SID"
    scan "$file" 'TWILIO_AUTH_TOKEN=.{10,}' "Twilio Auth Token value"

    # API keys
    scan "$file" 'sk-or-[a-zA-Z0-9]{20,}' "OpenRouter key"
    scan "$file" 'sk-[a-zA-Z0-9]{30,}' "OpenAI-style API key"
    scan "$file" 'DEEPGRAM_API_KEY=[a-f0-9]{20,}' "Deepgram key value"
    scan "$file" 'XIAOMI_API_KEY=[a-f0-9]{20,}' "Xiaomi key value"

    # Bot / service tokens
    scan "$file" '[0-9]{8,10}:[a-zA-Z0-9_-]{35}' "Telegram bot token"
    scan "$file" 'ghp_[a-zA-Z0-9]{36}' "GitHub PAT"
    scan "$file" 'github_pat_[a-zA-Z0-9_]{20,}' "GitHub fine-grained PAT"

    # Private keys
    scan "$file" 'BEGIN.*PRIVATE.KEY' "Private key block"

    # Phone numbers (real, not masked)
    real_phone=$(get_lines "$file" | grep -oE '\+[1-9][0-9]{10,14}' | grep -v '\*' || true)
    [ -n "$real_phone" ] && report "$file" "Unmasked phone number"

    # Generic .env secrets
    if [[ "$file" == *.env* ]] || [[ "$file" == *env.template ]]; then
        for kw in TOKEN SECRET API_KEY AUTH; do
            env_match=$(get_lines "$file" | grep -Ein "${kw}=.{20,}" || true)
            if [ -n "$env_match" ]; then
                is_placeholder=$(echo "$env_match" | grep -Eiv 'xxxx|your_|REPLACE|placeholder|example|changeme|auto-generated' || true)
                [ -n "$is_placeholder" ] && report "$file" "Possible hardcoded secret ($kw) in .env"
            fi
        done
    fi
done

if [ $FOUND -gt 0 ]; then
    echo -e "${RED}========================================${NC}"
    echo -e "${RED}  COMMIT BLOCKED - ${FOUND} potential secret(s)${NC}"
    echo -e "${RED}========================================${NC}"
    echo -e "$REPORT"
    echo ""
    echo -e "${YELLOW}Use placeholders instead:${NC}"
    echo "  TWILIO_ACCOUNT_SID=ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    echo "  TWILIO_AUTH_TOKEN=your_auth_token"
    echo "  API_KEY=your_api_key"
    echo "  Phone: +123****7890"
    echo ""
    echo -e "${YELLOW}Bypass (emergency only):${NC}"
    echo "  git commit --no-verify"
    echo ""
    exit 1
fi

echo -e "${GREEN}No secrets detected${NC}\n"
exit 0