#! /usr/bin/env bash
set -euo pipefail

readonly HOOK_NAME="$(basename "$0")"

if ! [[ "$HOOK_NAME" =~ ^(pre-(commit|push)|post-checkout)$ ]]
then
    echo "Unknown hook '${HOOK_NAME}'."
    exit 1
fi

readonly SENSITIVE_FILES=("justfile" "build.rs" "rust-toolchain.toml")
readonly BASE_BRANCH="master"

# Check which files were modified compared to the base branch.
mapfile -t CHANGED_FILES < <(comm -12 \
    <(git diff --name-only "${BASE_BRANCH}" | sort) \
    <(IFS=$'\n'; echo "${SENSITIVE_FILES[*]}" | sort) \
)

if [ ${#CHANGED_FILES[@]} -gt 0 ]; then
    echo "⚠️ WARNING: Sensitive files have been modified relative to $BASE_BRANCH."
    echo "Executing this hook may run arbitrary code from the modified files."
    echo ""

    git --no-pager diff "$BASE_BRANCH" -- "${SENSITIVE_FILES[@]}"

    # Read from /dev/tty because stdin is not attached to the terminal in Git hooks.
    exec < /dev/tty

    read -r -p "Do you want to continue executing the ${HOOK_NAME} hooks? [y/N] " response
    case "$response" in
        [yY][eE][sS]|[yY])
            echo "Continuing with '${HOOK_NAME}' hook..."
            ;;
        *)
            echo "Skipping '${HOOK_NAME}' hook."
            exit 0
            ;;
    esac
fi

# Execute the appropriate just recipe based on the hook name
if [ "$HOOK_NAME" = "pre-commit" ]; then
    echo "Running pre-commit checks..."
    just pre-commit
elif [ "$HOOK_NAME" = "pre-push" ]; then
    echo "Running pre-push checks..."
    just pre-push
else
    echo "Unknown hook: $HOOK_NAME"
    exit 1
fi