#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — LOCAL SECRET SURFACE (Gitleaks-like but read-only simple)
#
# Purpose: Quick bounded grep for common secret patterns in the local tree.
#          Purely evidence of presence of potential secrets — no exfil.
#
# Safety: Read-only, bounded depth and common safe paths only. Never sends data.
#
# Generated by Vigil safe-poc-generator (next iteration).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)
ROOT=${1:-.}

echo '{
  "validator": "secret-scan-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (next iteration)",
  "startedAt": "'"$STARTED"'",
  "root": "'"$ROOT"'",
  "patternsChecked": ["sk-","AIza","AKIA","-----BEGIN","password","secret","token"],
  "matches": [],'

MATCHES=$(grep -rE 'sk-[a-zA-Z0-9]{20,}|AIza[0-9A-Za-z-_]{10,}|AKIA[0-9A-Z]{16}|-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY|password\s*=\s*["'"'"'][^"'"'"']+["'"'"']|secret\s*=\s*["'"'"'][^"'"'"']+["'"'"']' "$ROOT" --include="*.js" --include="*.ts" --include="*.py" --include="*.env*" -l 2>/dev/null | head -10 | sed 's/"/\\"/g' || true)

echo '  "filesWithPotentialSecretsSample": ['"$(echo "$MATCHES" | sed 's/^/"/;s/$/"/' | paste -sd, -)"'],
  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "Potential secret surface enumerated locally (read-only grep). Review and rotate as needed."
}'
exit 0