#!/usr/bin/env bash
# Phase 0: scan production web bundle for forbidden identity-switch / seed strings.
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
DIST="${1:-$ROOT/web/dist}"

echo "Building fresh web dist..."
(cd "$ROOT/web" && npm run build)

FORBIDDEN=(
  'DevRoleSwitcher'
  'DEV 调试切人'
  '切换为此人登录'
  'admin-secret-password-123'
  'allowDevSwitch'
  'dev-token-'
)

failed=0
for needle in "${FORBIDDEN[@]}"; do
  if grep -rq --include='*.js' --include='*.css' --include='*.html' "$needle" "$DIST" 2>/dev/null; then
    echo "FAIL: forbidden string in bundle: $needle"
    failed=1
  fi
done

if [[ $failed -eq 0 ]]; then
  echo "PASS: prod bundle scan ($DIST)"
  exit 0
fi
exit 1