#!/usr/bin/env bash
# CO-001 lint-substitute (Carve-Outs Register v1.1, closed 2026-05-18).
#
# Fails (exit 1) if any server-side source file calls bcrypt.hash() or
# bcrypt.hashSync() with a literal numeric cost-factor argument instead of
# the BCRYPT_ROUNDS constant exported from server/lib/bcrypt-config.ts.
#
# Reasoning: the AEGIS standard requires uniform bcrypt cost 13 across all
# call sites. CO-001 was closed by extracting BCRYPT_ROUNDS to a shared
# constant module and replacing four literal-argument call sites with the
# constant. This script prevents the regression that would re-introduce
# cost-factor non-uniformity.
#
# Run manually:
#   bash scripts/check-bcrypt-cost-factor.sh
#
# This project has no pre-commit hook framework configured; wire this
# script into one if/when adopted.

set -u

# Match bcrypt.hash(<anything>, <digit>) or bcrypt.hashSync(<anything>, <digit>).
# The second argument must NOT be a literal digit — it must reference
# BCRYPT_ROUNDS (or another named constant).
PATTERN='bcrypt(js)?\.hash(Sync)?\([^,)]+,\s*[0-9]+\s*\)'

# Restrict scan to server-side sources (where credentials are issued).
# shared/ and client/ are intentionally excluded.
matches=$(rg -n -e "$PATTERN" server/ 2>/dev/null || true)

if [ -n "$matches" ]; then
  echo "CO-001 regression detected — bcrypt called with literal cost factor:"
  echo
  echo "$matches"
  echo
  echo "Use BCRYPT_ROUNDS from server/lib/bcrypt-config.ts instead."
  exit 1
fi

echo "CO-001 check passed — no literal bcrypt cost factors in server/."