#!/usr/bin/env bash
# Phase 0: scan production web bundle for forbidden identity-switch / demo-seed strings.
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
DIST="${1:-$ROOT/web/dist}"

echo "Building fresh web dist (demo seeds OFF)..."
(cd "$ROOT/web" && env -u VITE_ENABLE_DEMO_SEEDS npm run build)

# Note: id-pattern helpers (doc-001 / doc-neuropulse-) remain in the purge/filter code on purpose.
# Assert demo *content* and seed package markers are absent from the production bundle.
FORBIDDEN=(
  'DevRoleSwitcher'
  'DEV 调试切人'
  '切换为此人登录'
  'admin-secret-password-123'
  'allowDevSwitch'
  'dev-token-'
  # Demo / mock seed content (must not ship in production bundle)
  '4K超高清荧光'
  '4K荧光内窥镜'
  '微创外科全球竞品'
  '膝骨关节炎综合治疗仪'
  'doc-proj6001-'
  'MOCK_DOCUMENTS'
  'NEUROPULSE_DELIVERABLES'
  'TEN_PROJECTS_DELIVERABLES'
  '便携式掌上无线超声'
  'CUSA-Ultra'
)

failed=0
for needle in "${FORBIDDEN[@]}"; do
  if grep -rq --include='*.js' --include='*.css' --include='*.html' "$needle" "$DIST" 2>/dev/null; then
    echo "FAIL: forbidden string in bundle: $needle"
    failed=1
  fi
done

if [[ $failed -eq 0 ]]; then
  echo "PASS: prod bundle scan ($DIST)"
  exit 0
fi
exit 1