#!/usr/bin/env bash
set -euo pipefail

# Scan repository for residual obfuscated tokens like RdXXXXXX and fail if any found.
# Exits 0 when clean, non-zero when tokens are present.

ROOT="${1:-$(cd "$(dirname "$0")/../../.." && pwd)}"

echo "[obf-check] Scanning for residual obfuscated tokens in ${ROOT}"

EXCLUDE=("./Pods" "./.git" "./obfuscation_maps" "./build_output" "./DerivedData" "./readoorTests")

GREP_EXCLUDE_ARGS=()
for e in "${EXCLUDE[@]}"; do
  GREP_EXCLUDE_ARGS+=(--exclude-dir "${e#./}")
done

FOUND=0
TOKEN_SUFFIX_RE='(?:[a-f0-9]{6}|[a-f0-9]{8}|[a-f0-9]{10})'

echo "[obf-check] Looking for token pattern '\b(?:Rd|YMH)${TOKEN_SUFFIX_RE}\b' in source files..."
if grep -R --line-number -E "\\b(?:Rd|YMH)${TOKEN_SUFFIX_RE}\\b" --include='*.swift' --include='*.m' --include='*.mm' --include='*.h' "${ROOT}" "${GREP_EXCLUDE_ARGS[@]}"; then
  FOUND=1
fi

echo "[obf-check] Looking for obfuscated header imports like \"(Rd|YMH)XXXXXX.h\"..."
if grep -R --line-number -E "#import\\s+\"(?:Rd|YMH)${TOKEN_SUFFIX_RE}\\.h\"" --include='*.pch' --include='*.h' --include='*.m' --include='*.mm' "${ROOT}" "${GREP_EXCLUDE_ARGS[@]}"; then
  FOUND=1
fi

if [[ ${FOUND} -ne 0 ]]; then
  echo "[obf-check] ERROR: Found residual obfuscated tokens; aborting to avoid double-obfuscation."
  echo "[obf-check] Run: python3 AutoPacking/obfuscation/obfuscate_symbols.py --restore-source-from-map-dir obfuscation_maps  or run the auto-restore tool before archiving."
  exit 2
fi

echo "[obf-check] Clean: no residual obfuscated tokens found."
exit 0