#!/bin/bash
# KB pre-commit hook: frontmatter validation + secret detection + index rebuild
KB_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
ERRORS=0

for f in $(git diff --cached --name-only --diff-filter=ACM -- '*.md'); do
  case "$f" in .kb/*|templates/*|99-personal/*|00-inbox/*|README.md) continue;; esac

  if ! head -1 "$f" | grep -q '^---'; then
    echo "ERROR: $f — frontmatter 없음"; ERRORS=$((ERRORS+1))
  fi
  if ! grep -q 'tldr:' "$f"; then
    echo "ERROR: $f — tldr 필드 없음"; ERRORS=$((ERRORS+1))
  fi
  if ! grep -q 'tags:' "$f"; then
    echo "ERROR: $f — tags 필드 없음"; ERRORS=$((ERRORS+1))
  fi
done

# Secret detection — gitleaks first, regex fallback
if command -v gitleaks &> /dev/null; then
  gitleaks protect --staged --no-banner
  if [ $? -ne 0 ]; then
    echo "ERROR: gitleaks가 민감 정보를 탐지했습니다."; ERRORS=$((ERRORS+1))
  fi
else
  STAGED_MD=$(git diff --cached --name-only --diff-filter=ACM -- '*.md')
  if [ -n "$STAGED_MD" ] && echo "$STAGED_MD" | xargs grep -l 'password\|secret\|jdbc:\|api[_-]key\|token=' 2>/dev/null; then
    echo "ERROR: 민감 정보가 포함된 파일이 있습니다."; ERRORS=$((ERRORS+1))
    echo "TIP: brew install gitleaks 로 더 정밀한 탐지를 사용할 수 있습니다."
  fi
fi

if [ $ERRORS -gt 0 ]; then exit 1; fi

# Auto-rebuild index if .md files changed
STAGED_MD=$(git diff --cached --name-only --diff-filter=ACDMR -- '*.md')
if [ -n "$STAGED_MD" ]; then
  "$KB_ROOT/.kb/scripts/rebuild-index.sh" > /dev/null
  git add "$KB_ROOT/kb-index.json" "$KB_ROOT/.kb-index.local.json" 2>/dev/null
  echo "kb-index 자동 갱신 완료"
fi
