#!/usr/bin/env bash
# IP-FENCE smoke: fail on Nintendo / OpenKrush tokens outside allowlisted docs.
# See docs/IP-FENCE.md. Exit 0 → FENCE PASS; non-zero → FENCE FAIL.
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"

# Case-insensitive; word-ish Mario. OpenKrush = forbidden packs.
PATTERN='Magikoopa|Kamek|\bMario\b|Bowser|OpenKrush'

# Paths to scan (tracked-ish product / kitchen surfaces). Skip .git + kitchen/raw.
SCAN_PATHS=()
[[ -d scripts ]] && SCAN_PATHS+=(scripts)
[[ -d game ]] && SCAN_PATHS+=(game)
[[ -d assets ]] && SCAN_PATHS+=(assets)
[[ -f kitchen/ACTIVITY.md ]] && SCAN_PATHS+=(kitchen/ACTIVITY.md)
[[ -d kitchen/outbox ]] && SCAN_PATHS+=(kitchen/outbox)
# kitchen prose that must stay original (not raw model dumps)
for f in kitchen/PERSONAS.md kitchen/PLAYBOOK.md kitchen/STATUS.md kitchen/README.md; do
  [[ -f "$f" ]] && SCAN_PATHS+=("$f")
done

# Allowlist: fence definition + README stop-line + docs that *ban* the names
allowlisted() {
  local f="$1"
  case "$f" in
    docs/IP-FENCE.md|README.md|docs/FACTIONS.md|docs/CINEMATICS.md|docs/GAMEPLAY.md) return 0 ;;
    scripts/smoke/ip_fence_check.sh|scripts/smoke/README.md|kitchen/patches/D2.md) return 0 ;;
    *) return 1 ;;
  esac
}

if [[ ${#SCAN_PATHS[@]} -eq 0 ]]; then
  echo "FENCE FAIL: no scan paths under $ROOT"
  exit 2
fi

# Collect matches: path:line:text (rg may be missing → grep -R fallback)
TMP="$(mktemp)"
trap 'rm -f "$TMP"' EXIT

if command -v rg >/dev/null 2>&1; then
  rg -n -i -e "$PATTERN" \
    --glob '!.git/**' \
    --glob '!kitchen/raw/**' \
    --glob '!*.mp4' --glob '!*.png' --glob '!*.jpg' --glob '!*.jpeg' \
    --glob '!*.webp' --glob '!*.bin' --glob '!*.pak' --glob '!*.ogg' \
    --glob '!*.wav' --glob '!*.webm' \
    "${SCAN_PATHS[@]}" >"$TMP" 2>/dev/null || true
else
  grep -R -n -I -i -E "$PATTERN" "${SCAN_PATHS[@]}" \
    --exclude-dir=.git --exclude-dir=raw \
    --exclude='*.mp4' --exclude='*.png' --exclude='*.jpg' \
    >"$TMP" 2>/dev/null || true
fi

FAIL_LINES=()
while IFS= read -r line || [[ -n "${line:-}" ]]; do
  [[ -z "$line" ]] && continue
  # rg: path:lineno:content
  path="${line%%:*}"
  # strip leading ./
  path="${path#./}"
  if allowlisted "$path"; then
    continue
  fi
  FAIL_LINES+=("$line")
done <"$TMP"

if [[ ${#FAIL_LINES[@]} -gt 0 ]]; then
  echo "FENCE FAIL"
  printf '%s\n' "${FAIL_LINES[@]}"
  exit 1
fi

echo "FENCE PASS"
exit 0