import type { HookEvent } from '../../src/types.js';
import { scanForSecrets } from '../../src/rules/secret-patterns.js';
import { writeAuditLog } from '../../src/utils/logger.js';
import { formatAlert } from '../../src/utils/alert.js';

const handler = async (event: HookEvent): Promise<void> => {
  try {
    const { type, action, context, sessionKey, timestamp, messages } = event;
    if (type !== 'message') return;

    const content = context.content ?? '';
    if (!content) return;

    const result = scanForSecrets(content);
    if (!result.matched) return;

    const alertText = formatAlert(result.findings);

    if (action === 'received') {
      messages.push(
        `🔑 **Secrets Scanner Warning**\n` +
          `Sensitive credentials detected in your message. Please rotate them immediately!\n\n` +
          alertText,
      );
    } else if (action === 'sent') {
      messages.push(
        `🔑 **Secrets Scanner Warning**\n` +
          `Credential leak detected in AI response. These values should not be echoed.\n\n` +
          alertText,
      );
    }

    writeAuditLog({
      timestamp: timestamp.toISOString(),
      event: `${type}:${action}`,
      sessionKey,
      channel: context.channelId,
      isGroup: context.isGroup,
      alerts: result.findings,
      metadata: { messageLength: content.length },
    });
  } catch (err) {
    console.error(
      '[security-guardrails:secrets-scanner] Error:',
      err instanceof Error ? err.message : String(err),
    );
    writeAuditLog({
      timestamp: new Date().toISOString(),
      event: 'hook_error',
      sessionKey: event.sessionKey,
      alerts: [],
      metadata: { hook: 'secrets-scanner', error: err instanceof Error ? err.message : String(err) },
    });
  }
};

export default handler;