# Security Tasks
# Provides local SAST scanning

version: '3'

vars:
  DEFAULT_PATTERNS: '*.json,**/*.json,!node_modules/**,!dist/**,!.taskmaster/**'

tasks:
  default:
    desc: 'Show available security tasks'
    aliases: [help, h]
    silent: true
    cmds:
      - |
        # Color codes
        GREEN='\033[0;32m'
        YELLOW='\033[0;33m'
        BOLD='\033[1m'
        NC='\033[0m'

        echo -e "${BOLD}Security${NC}"
        echo ""
        echo "Command                            Alias     Description                              Examples"
        echo "───────────────────────────────────────────────────────────────────────────────────────────────────"
        echo -e "  ${GREEN}task security:scan${NC}               ${YELLOW}s${NC}         Run semgrep security scanner         "
        echo -e "  ${GREEN}task security:fix${NC}                ${YELLOW}f${NC}         Auto-fix security issues             "
        echo -e "  ${GREEN}task security:trufflehog${NC}         ${YELLOW}th${NC}        Scan for secrets with truffleHog     "

  scan:
    desc: Run security scanner on entire repo
    aliases: [s]
    silent: true
    cmds:
      - |
        # Source secrets if .env has 1Password references
        if [ -f .env ] && grep -q "op://" .env 2>/dev/null; then
          TEMP_ENV=$(task op:export)
          source "$TEMP_ENV"
        fi
        semgrep --config=auto --allow-local-builds -q

  fix:
    desc: Run security scanner on entire repo and automatically apply fixes
    aliases: [sf]
    silent: true
    cmds:
      - |
        # Source secrets if .env has 1Password references
        if [ -f .env ] && grep -q "op://" .env 2>/dev/null; then
          TEMP_ENV=$(task op:export)
          source "$TEMP_ENV"
        fi
        semgrep --config=auto --autofix --allow-local-builds -q

  trufflehog:
    desc: Run truffleHog secret scanner
    silent: true
    aliases: [th]
    cmds:
      - |
        GREEN='\033[0;32m'
        YELLOW='\033[0;33m'
        RED='\033[0;31m'
        NC='\033[0m'

        echo -e "${YELLOW}🔍${NC} Running truffleHog secret scanner..."

        # Check if trufflehog is installed, install if not
        if ! command -v trufflehog >/dev/null 2>&1; then
          echo -e "${YELLOW}⚠️${NC}  trufflehog not installed, installing..."
          brew install trufflehog
        fi

        # Create temporary exclusion file (regex patterns for directories to skip)
        EXCLUDE_FILE=$(mktemp)
        {
          echo "node_modules/"
          echo "__pycache__/"
          echo "venv/"
          echo "\.venv/"
          echo "dist/"
          echo "build/"
          echo "\.git/"
          echo "\.taskmaster/"
          echo "\.logs/"
          echo "coverage/"
        } > "$EXCLUDE_FILE"

        # Run truffleHog on current directory (exclude common build/dependency dirs)
        echo "Scanning filesystem..."
        if trufflehog filesystem . --exclude-paths="$EXCLUDE_FILE" --no-update --fail; then
          echo -e "${GREEN}✓${NC} No secrets found by truffleHog"
          EXIT_CODE=0
        else
          echo -e "${RED}❌${NC} truffleHog found secrets!"
          EXIT_CODE=1
        fi

        # Clean up temporary file
        rm -f "$EXCLUDE_FILE"
        exit $EXIT_CODE