#!/bin/sh
# Kvitt pre-commit hook: the fast subset of both gates. Installed by tools/install-git-hooks.sh.
# Each check runs only when its project exists, so the hook works on branches before android/ or server/ exist.
set -e
top=$(git rev-parse --show-toplevel)

# Secrets and personal data never reach git (CLAUDE.md › Never commit).
bad=$(git -C "$top" ls-files --cached -- '*local.properties' '*.jks' '*.keystore' '*.p12' '*.aar' 'models/' 'export/' \
  '*service-account*.json' '*google-services.json' '*.pem' '*.sqlite' '*.db' 'infra/secrets/' | head -5)
if [ -n "$bad" ]; then
  echo "pre-commit: a secret, keystore, vendor binary or personal-data file is staged or tracked:" >&2
  echo "$bad" >&2
  echo "Unstage with: git rm --cached <file>" >&2
  exit 1
fi

# Android: the pure model tests, through the one-build-at-a-time lock, with JDK 25 first on PATH and JAVA_HOME
# untouched (CLAUDE.md › Build and verify); the shell's java may be a stub.
if [ -x "$top/android/gradlew" ] && [ -d "$top/android/core/model" ] && [ -x "$top/tools/gradle-serial.sh" ]; then
  [ -d /opt/homebrew/opt/openjdk@25/bin ] && PATH="/opt/homebrew/opt/openjdk@25/bin:$PATH"
  "$top/tools/gradle-serial.sh" --quiet :core:model:test :domain:test || {
    echo "pre-commit: Android fast tests failed (see above). Run tools/gradle-serial.sh check for the full picture." >&2
    exit 1
  }
fi

# Server: the pure domain crate tests.
if [ -f "$top/server/Cargo.toml" ] && [ -d "$top/server/crates/kvitt-domain" ] && command -v cargo >/dev/null 2>&1; then
  (cd "$top/server" && cargo test --quiet -p kvitt-domain) || {
    echo "pre-commit: kvitt-domain tests failed (see above). Run the server gate for the full picture." >&2
    exit 1
  }
fi

# Server: cargo audit, only when a dependency changed (server/Cargo.lock or a Cargo.toml staged), so ordinary
# commits stay fast. Offline (--no-fetch: the advisory database in ~/.cargo/advisory-db as last fetched by the gate).
# A missing cargo-audit or a database never fetched skips the check with a message; it never fails the commit.
if [ -f "$top/server/Cargo.lock" ] && git -C "$top" diff --cached --name-only -- 'server/Cargo.lock' 'server/Cargo.toml' \
  'server/**/Cargo.toml' | grep -q .; then
  if ! command -v cargo-audit >/dev/null 2>&1; then
    echo "pre-commit: cargo-audit is not installed; skipping the dependency audit (cargo install cargo-audit --locked)." >&2
  elif [ ! -d "${CARGO_HOME:-$HOME/.cargo}/advisory-db" ]; then
    echo "pre-commit: no advisory database yet; skipping the dependency audit (run cargo audit once from server/)." >&2
  else
    (cd "$top/server" && cargo audit --no-fetch --quiet) || {
      echo "pre-commit: cargo audit found advisories in server/Cargo.lock (see above). Fix them, or see server/README.md." >&2
      exit 1
    }
  fi
fi
