#!/bin/bash
# Techstack Enforcer - Pre-commit Hook
# Blocks commits containing forbidden technologies
# Install: ln -sf /path/to/techstack-hook ~/.git/hooks/pre-commit

set -euo pipefail

# Configuration
TECHSTACK_BIN="${TECHSTACK_BIN:-techstack-enforcer}"
TECHSTACK_MODE="${TECHSTACK_MODE:-enforce}"
TECHSTACK_NOTIFY="${TECHSTACK_NOTIFY:-1}"

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
CYAN='\033[0;36m'
BOLD='\033[1m'
RESET='\033[0m'

echo -e "${CYAN}[techstack]${RESET} Pre-commit check..."

# Check if techstack-enforcer is available
if ! command -v "$TECHSTACK_BIN" &> /dev/null; then
    # Fall back to checking patterns directly
    echo -e "${YELLOW}[techstack]${RESET} Enforcer not found, using fallback checks..."

    # Get staged files
    STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || echo "")

    if [ -z "$STAGED_FILES" ]; then
        echo -e "${GREEN}[techstack]${RESET} No files staged"
        exit 0
    fi

    VIOLATIONS=0
    FATAL=0

    # Check each staged file
    while IFS= read -r file; do
        [ -z "$file" ] && continue

        case "$file" in
            # FATAL: Absolutely blocked
            *.py|*.pyc|*.pyo)
                echo -e "${RED}${BOLD}FATAL:${RESET} $file - Python is blocked"
                ((FATAL++)) || true
                ((VIOLATIONS++)) || true
                ;;
            requirements.txt|Pipfile|pyproject.toml|setup.py)
                echo -e "${RED}${BOLD}FATAL:${RESET} $file - Python dependency file"
                ((FATAL++)) || true
                ((VIOLATIONS++)) || true
                ;;
            *.php|composer.json)
                echo -e "${RED}${BOLD}FATAL:${RESET} $file - PHP is blocked"
                ((FATAL++)) || true
                ((VIOLATIONS++)) || true
                ;;

            # BLOCK: Blocked in enforce mode
            Dockerfile*|docker-compose*)
                echo -e "${YELLOW}BLOCK:${RESET} $file - Use Containerfile/podman instead"
                ((VIOLATIONS++)) || true
                ;;
            *.c|*.cpp|*.cc|*.cxx)
                echo -e "${YELLOW}BLOCK:${RESET} $file - C/C++ is memory-unsafe, use Rust/Ada"
                ((VIOLATIONS++)) || true
                ;;
            *.js|*.jsx|*.mjs|*.cjs)
                echo -e "${YELLOW}BLOCK:${RESET} $file - Use TypeScript or ReScript"
                ((VIOLATIONS++)) || true
                ;;
            *.rb|Gemfile*)
                echo -e "${YELLOW}BLOCK:${RESET} $file - Ruby is dynamically typed"
                ((VIOLATIONS++)) || true
                ;;

            # WARN: Warning only
            *.h|*.hpp)
                echo -e "${YELLOW}WARN:${RESET} $file - C/C++ header detected"
                ;;
            .github/*)
                echo -e "${YELLOW}WARN:${RESET} $file - Consider GitLab CI instead"
                ;;
            *.sh|*.bash)
                echo -e "${YELLOW}WARN:${RESET} $file - Shell script, be cautious"
                ;;

            # ALLOWED: Memory-safe languages
            *.rs|*.adb|*.ads|*.gpr)
                ;;  # Rust/Ada - encouraged
            *.hs|*.lhs|*.cabal)
                ;;  # Haskell - encouraged
            *.ex|*.exs)
                ;;  # Elixir - encouraged
            *.erl|*.hrl)
                ;;  # Erlang - encouraged
            *.res|*.resi)
                ;;  # ReScript - encouraged
            *.ml|*.mli)
                ;;  # OCaml - encouraged
            *.elm)
                ;;  # Elm - encouraged
            *.ts|*.tsx)
                ;;  # TypeScript - acceptable
            *.nix|flake.*)
                ;;  # Nix - encouraged
            Containerfile|.gitlab-ci.yml)
                ;;  # Podman/GitLab - encouraged
            *.toml|*.yaml|*.yml|*.json|*.md|*.txt)
                ;;  # Config/docs - allowed
            Cargo.toml|Cargo.lock|mix.exs|mix.lock|stack.yaml|package.yaml)
                ;;  # Build files for safe langs - allowed
        esac
    done <<< "$STAGED_FILES"

    # Determine outcome
    if [ "$FATAL" -gt 0 ]; then
        echo ""
        echo -e "${RED}${BOLD}======================================${RESET}"
        echo -e "${RED}${BOLD}  COMMIT BLOCKED: $FATAL FATAL VIOLATION(S)${RESET}"
        echo -e "${RED}${BOLD}======================================${RESET}"
        echo ""
        echo -e "Remove the offending files or use a memory-safe language."
        echo -e "See: ${CYAN}techstack-enforcer list${RESET} for allowed technologies"

        # Desktop notification
        if [ "$TECHSTACK_NOTIFY" = "1" ] && command -v notify-send &> /dev/null; then
            notify-send -u critical "TECHSTACK BLOCKED" \
                "Commit blocked: $FATAL fatal violations\n$VIOLATIONS total violations"
        fi

        exit 1
    elif [ "$VIOLATIONS" -gt 0 ] && [ "$TECHSTACK_MODE" = "lockdown" ]; then
        echo ""
        echo -e "${RED}${BOLD}======================================${RESET}"
        echo -e "${RED}${BOLD}  COMMIT BLOCKED: LOCKDOWN MODE${RESET}"
        echo -e "${RED}${BOLD}======================================${RESET}"
        exit 1
    elif [ "$VIOLATIONS" -gt 0 ]; then
        echo ""
        echo -e "${YELLOW}${BOLD}======================================${RESET}"
        echo -e "${YELLOW}${BOLD}  WARNING: $VIOLATIONS VIOLATION(S) FOUND${RESET}"
        echo -e "${YELLOW}${BOLD}======================================${RESET}"
        echo -e "Commit allowed, but please review the warnings above."
    else
        echo -e "${GREEN}[techstack]${RESET} All checks passed"
    fi

    exit 0
fi

# Run the Ada enforcer
"$TECHSTACK_BIN" audit --mode="$TECHSTACK_MODE" --fatal-exit $([ "$TECHSTACK_NOTIFY" = "1" ] && echo "--notify")
exit $?
