guardy 0.2.4

// All filtering now handled through cached filters in Scanner struct and collect_file_paths
use std::{
    path::{Path, PathBuf},
    sync::Arc,
};

use anyhow::{Context, Result};
use ignore::{WalkBuilder, gitignore::GitignoreBuilder};

use super::types::{ScanStats, Scanner, SecretMatch};
use crate::config::CONFIG;

/// Execution mode determined by file count and configuration
#[derive(Debug, Clone, Copy, PartialEq)]
enum RunMode {
    Sequential,
    Parallel { workers: usize },
}

/// Check if a file should be ignored according to .guardyignore patterns
fn should_ignore_file(path: &Path) -> bool {
    // Find the repository root (where .guardyignore should be)
    let current_dir = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
    let guardyignore_path = current_dir.join(".guardyignore");

    tracing::trace!(
        "Checking .guardyignore for: {} (current_dir: {}, guardyignore_exists: {})",
        path.display(),
        current_dir.display(),
        guardyignore_path.exists()
    );

    if !guardyignore_path.exists() {
        return false;
    }

    // Build gitignore matcher from .guardyignore file
    let mut builder = GitignoreBuilder::new(&current_dir);
    if let Some(e) = builder.add(&guardyignore_path) {
        tracing::warn!("Failed to load .guardyignore: {}", e);
        return false;
    }

    let gitignore = match builder.build() {
        Ok(gi) => gi,
        Err(e) => {
            tracing::warn!("Failed to build gitignore matcher: {}", e);
            return false;
        }
    };

    // Check if path matches any ignore patterns
    let matched = gitignore.matched(path, path.is_dir());
    let is_ignored = matched.is_ignore();

    tracing::trace!(
        "Path {} matched: {:?}, is_ignored: {}",
        path.display(),
        matched,
        is_ignored
    );

    is_ignored
}

// ============================================================================
// IMPORTANT: All scanner types should be defined in types.rs, not here!
// This keeps the codebase modular and prevents type duplication.
// Only implement behavior (impl blocks) in this file.
// ============================================================================

impl Scanner {
    pub fn new() -> Result<Self> {
        // Initialize filters once from CONFIG for reuse throughout scanning
        let scanner_config = &CONFIG.scanner;
        let binary_filter = std::sync::Arc::new(super::filters::directory::BinaryFilter::new(
            !scanner_config.include_binary,
        ));
        let path_filter = std::sync::Arc::new(super::filters::directory::PathFilter::new(
            scanner_config.ignore_paths.clone(),
        ));
        let size_filter = std::sync::Arc::new(super::filters::directory::SizeFilter::new(
            scanner_config.max_file_size_mb,
        ));

        // Initialize content filters for optimization
        let prefilter = std::sync::Arc::new(super::filters::content::ContextPrefilter::new());
        let regex_executor = std::sync::Arc::new(super::filters::content::RegexExecutor::new());
        let comment_filter = std::sync::Arc::new(super::filters::content::CommentFilter::new());

        // Initialize pattern library statistics
        let pattern_lib = super::static_data::patterns::get_pattern_library();
        super::counters::set_pattern_stats(pattern_lib.count(), pattern_lib.keywords().len());

        Ok(Scanner {
            binary_filter,
            path_filter,
            size_filter,
            prefilter,
            regex_executor,
            comment_filter,
        })
    }

    // All filters are initialized from GUARDY_CONFIG and cached for performance
    // These Arc-wrapped filters are reused throughout the scanning process

    // Config parsing functions removed - now using GUARDY_CONFIG directly

    /// Build a WalkBuilder with common directory filtering logic and statistics tracking
    pub(crate) fn build_directory_walker(&self, path: &Path) -> WalkBuilder {
        let mut builder = WalkBuilder::new(path);
        builder
            .follow_links(CONFIG.scanner.follow_symlinks)
            .git_ignore(true) // Respect .gitignore files
            .git_global(true) // Respect global gitignore
            .git_exclude(true) // Respect .git/info/exclude
            .hidden(false) // Don't ignore hidden files by default
            .parents(true) // Check parent directories for .gitignore
            .add_custom_ignore_filename(".guardyignore"); // Respect .guardyignore files (hierarchical)

        // Create fast directory filtering using static data
        let path_filter = self.path_filter.clone();

        builder.filter_entry(move |entry| {
            // FIRST: Fast directory filtering by name (prevents descent)
            if entry.file_type().is_some_and(|ft| ft.is_dir())
                && let Some(dir_name) = entry.file_name().to_str()
                && super::static_data::directory_patterns::SKIP_DIRECTORIES_SET.contains(dir_name)
            {
                tracing::trace!("Skipping directory: {}", entry.path().display());
                super::counters::COUNT_DISCOVERY_PATH_FILTERED
                    .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                return false; // Don't descend into this directory
            }

            // SECOND: Apply PathFilter for file patterns (user-configurable)
            // Only check files, not directories (directories already handled above)
            if entry.file_type().is_some_and(|ft| ft.is_file()) {
                use super::filters::Filter;
                match path_filter.filter(entry.path()) {
                    Ok(super::filters::FilterDecision::Skip(reason)) => {
                        tracing::trace!("Skipped file {}: {}", entry.path().display(), reason);
                        super::counters::COUNT_DISCOVERY_PATH_FILTERED
                            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                        return false;
                    }
                    Ok(super::filters::FilterDecision::Process) => {
                        tracing::trace!("Allowed file {}", entry.path().display());
                    }
                    Err(e) => {
                        tracing::trace!("Path filter failed for {}: {}", entry.path().display(), e);
                    }
                }
            }

            true // Allow everything else
        });

        builder
    }

    /// Scan paths (files and directories) using appropriate execution strategy
    pub fn scan(&self, paths: &[PathBuf]) -> Result<ScanStats> {
        let start_time = std::time::Instant::now();

        // Parse output configuration flags
        let show_matches = CONFIG.scanner.show;
        let show_sensitive = CONFIG.scanner.sensitive;

        // 1. Collect all file paths from all input paths FIRST
        // We need the file count to determine execution mode
        let mut all_files = Vec::new();
        for path in paths {
            if path.is_file() {
                // Check .guardyignore patterns for directly specified files
                if should_ignore_file(path) {
                    tracing::debug!("Ignoring file per .guardyignore: {}", path.display());
                    super::counters::COUNT_DISCOVERY_PATH_FILTERED
                        .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                    continue;
                }
                all_files.push(path.clone());
            } else if path.is_dir() {
                let mut dir_files = self.collect_files_from_directory(path)?;
                all_files.append(&mut dir_files);
            } else {
                eprintln!("Warning: Path not found: {}", path.display());
            }
        }

        // 2. Determine execution mode based on file count and configuration
        let run_mode = if all_files.len() <= 3 {
            // Always use sequential for very small file counts (like old version)
            RunMode::Sequential
        } else {
            // For larger file counts, calculate optimal worker count
            let system = system_profile::SystemProfile::get();
            let thread_percentage = crate::config::CONFIG.scanner.thread_percentage as usize;
            let max_threads = crate::config::CONFIG.scanner.max_threads as usize;
            let max_workers = system.calculate_workers_with_limit(thread_percentage, max_threads);
            let optimal_workers = system.adapt_workers_for_workload(all_files.len(), max_workers);
            RunMode::Parallel {
                workers: optimal_workers,
            }
        };

        tracing::debug!(
            "Execution mode: {:?} for {} files",
            run_mode,
            all_files.len()
        );

        // 3. Initialize progress display (show for all modes when TTY enabled)
        let show_progress = CONFIG.scanner.tty;
        let progress = super::progress::ProgressDisplay::new(show_progress);
        let progress_handle = if show_progress {
            Some(progress.start_background_updates())
        } else {
            None
        };

        // 4. Initialize report writer (only if --report flag is provided)
        let (report_writer, report_handle) = if let Some(report_path) = &CONFIG.scanner.report {
            let writer = super::reports::ReportWriter::new(report_path)?;
            let handle = writer.get_atomic_handle();
            (Some(writer), Some(handle))
        } else {
            (None, None)
        };

        if all_files.is_empty() {
            let empty_stats = ScanStats {
                files_scanned: 0,
                files_skipped: 0,
                processing_errors: 0,
                total_matches: 0,
                scan_duration_ms: start_time.elapsed().as_millis() as u64,
            };

            if show_progress {
                progress.finish(&empty_stats);
                if let Some(handle) = progress_handle {
                    handle.join().ok();
                }
            }

            return Ok(empty_stats);
        }

        // 5. Execute based on the determined run mode
        match run_mode {
            RunMode::Sequential => {
                tracing::debug!("Using sequential execution for {} files", all_files.len());

                for file_path in all_files {
                    match self.process_file(
                        Arc::new(file_path),
                        show_matches,
                        show_sensitive,
                        report_handle.as_ref(),
                    ) {
                        Ok(_) => {
                            super::counters::FILES_PROCESSED
                                .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                        }
                        Err(_) => {
                            super::counters::COUNT_PROCESSING_FAILED
                                .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                        }
                    }
                }
            }
            RunMode::Parallel { workers } => {
                tracing::debug!(
                    "Using parallel execution with {} workers for {} files",
                    workers,
                    all_files.len()
                );

                // Process files in parallel with streaming output
                super::parallel::run(
                    all_files,
                    {
                        let scanner = self.clone();
                        let report_handle_clone = report_handle.clone();
                        move |file_path: &PathBuf| {
                            // Design decision: We create Arc<PathBuf> here rather than during file collection
                            // because many files get filtered out (binary, size, path filters) before reaching
                            // workers. Creating Arc only for files we actually process avoids wasted allocations.
                            // All matches from this file will share this single Arc, saving memory.
                            match scanner.process_file(
                                Arc::new(file_path.clone()),
                                show_matches,
                                show_sensitive,
                                report_handle_clone.as_ref(),
                            ) {
                                Ok(_) => {
                                    super::counters::FILES_PROCESSED
                                        .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                                }
                                Err(_) => {
                                    super::counters::COUNT_PROCESSING_FAILED
                                        .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                                }
                            }
                        }
                    },
                    workers,
                )?;
            }
        }

        // 3. Finalize report writer (write suffix and close file)
        if let Some(writer) = report_writer {
            writer.finalize()?;
        }

        // 4. Get final stats from atomic counters
        let (
            files_processed,
            binary_filtered,
            size_filtered,
            path_filtered,
            processing_failed,
            matches_found,
        ) = super::counters::get_counts();
        let total_files_skipped = binary_filtered + size_filtered + path_filtered;

        let final_stats = ScanStats {
            files_scanned: files_processed,
            files_skipped: total_files_skipped,
            processing_errors: processing_failed,
            total_matches: matches_found,
            scan_duration_ms: start_time.elapsed().as_millis() as u64,
        };

        // 5. Show filter statistics for debugging
        self.show_filter_stats();

        // 7. Finish progress display
        if show_progress {
            progress.finish(&final_stats);
            if let Some(handle) = progress_handle {
                handle.join().ok(); // Wait for progress thread to finish
            }
        }

        Ok(final_stats)
    }

    /// Collect all files from a directory with filtering
    fn collect_files_from_directory(&self, path: &Path) -> Result<Vec<PathBuf>> {
        let walker = self.build_directory_walker(path).build();
        let mut file_paths = Vec::new();

        for entry in walker {
            match entry {
                Ok(entry) => {
                    if entry.file_type().is_some_and(|ft| ft.is_file()) {
                        let file_path = entry.path();

                        // Apply size filter
                        if self.apply_size_filter(file_path).is_err() {
                            continue;
                        }

                        // Apply binary filter
                        if self.apply_binary_filter(file_path).is_err() {
                            continue;
                        }

                        file_paths.push(file_path.to_path_buf());
                    }
                }
                Err(e) => {
                    tracing::debug!("Directory walk error: {}", e);
                }
            }
        }

        Ok(file_paths)
    }

    /// Process a single file with conditional output
    fn process_file(
        &self,
        file_path: Arc<PathBuf>,
        show_matches: bool,
        show_sensitive: bool,
        report_handle: Option<&super::reports::AtomicHandle>,
    ) -> Result<()> {
        let file_start = std::time::Instant::now();

        // Get memory usage before processing this file
        let memory_before = if let Ok(status) = std::fs::read_to_string("/proc/self/status") {
            status
                .lines()
                .find(|l| l.starts_with("VmRSS:"))
                .and_then(|line| line.split_whitespace().nth(1))
                .and_then(|val| val.parse::<u64>().ok())
                .unwrap_or(0)
        } else {
            0
        };

        // Get file size
        let file_size = std::fs::metadata(file_path.as_ref())
            .map(|m| m.len())
            .unwrap_or(0);

        // Get current thread info (approximate worker ID)
        let thread_name = std::thread::current()
            .name()
            .unwrap_or("unknown")
            .to_string();
        // Read file content into Arc<String> to share across filters without copying
        let content = Arc::new(
            std::fs::read_to_string(file_path.as_ref())
                .with_context(|| format!("Failed to read file: {}", file_path.display()))?,
        );

        // Check for guardy:ignore-file directive
        if content
            .lines()
            .take(10)
            .any(|line| line.contains("guardy:ignore-file"))
        {
            tracing::debug!(
                "Skipping file {} due to guardy:ignore-file directive",
                file_path.display()
            );
            return Ok(());
        }

        // Scan content for matches - pass Arc<String> through
        let matches = self.scan_content(content.clone(), file_path.clone())?;

        if !matches.is_empty() {
            // Update matches counter
            super::counters::MATCHES_FOUND
                .fetch_add(matches.len(), std::sync::atomic::Ordering::Relaxed);

            // Conditionally stream to stdout based on --show flag
            if show_matches {
                // Use file_path from the first match - all matches share the same Arc<PathBuf>
                let mut output = format!("\n📄 {}\n", matches[0].file_path.display());
                for secret_match in &matches {
                    let content = if show_sensitive {
                        secret_match.line_content.trim()
                    } else {
                        "[REDACTED]"
                    };
                    output.push_str(&format!(
                        "  🔍 Line {}:{} {} {}\n",
                        secret_match.line_number,
                        secret_match.start_pos,
                        secret_match.pattern.name,
                        content
                    ));
                }
                print!("{output}");
            }

            // Conditionally stream to report file based on --report flag
            if let Some(handle) = report_handle {
                handle.write_matches(&matches, !show_sensitive)?;
            }
        }

        // Get memory usage after processing this file
        let memory_after = if let Ok(status) = std::fs::read_to_string("/proc/self/status") {
            status
                .lines()
                .find(|l| l.starts_with("VmRSS:"))
                .and_then(|line| line.split_whitespace().nth(1))
                .and_then(|val| val.parse::<u64>().ok())
                .unwrap_or(0)
        } else {
            0
        };

        let memory_delta = memory_after as i64 - memory_before as i64;

        // Log if this file caused significant memory increase (>10MB) - only at debug level
        if !(-10_000..=10_000).contains(&memory_delta) {
            tracing::debug!(
                "🚨 MEMORY: {} processed {} ({} bytes) - Memory: {} KB → {} KB (Δ{:+} KB) matches: {}",
                thread_name,
                file_path.display(),
                file_size,
                memory_before,
                memory_after,
                memory_delta,
                matches.len()
            );
        }

        // Explicitly drop matches vector to free memory immediately
        drop(matches);
        // Explicitly drop file content Arc to free memory immediately
        drop(content);

        let file_duration = file_start.elapsed();
        tracing::trace!(
            "Processed file {} in {}",
            file_path.display(),
            crate::shared::time::format_time(file_duration)
        );

        Ok(())
    }

    /// Apply size filter to a file path
    fn apply_size_filter(&self, file_path: &Path) -> Result<()> {
        use super::filters::Filter;
        match self.size_filter.filter(file_path) {
            Ok(super::filters::FilterDecision::Skip(reason)) => {
                tracing::trace!(
                    "Filter '{}' skipped {}: {}",
                    self.size_filter.name(),
                    file_path.display(),
                    reason
                );
                super::counters::COUNT_DISCOVERY_SIZE_FILTERED
                    .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                Err(anyhow::anyhow!("File skipped by size filter"))
            }
            Ok(super::filters::FilterDecision::Process) => {
                tracing::trace!(
                    "Filter '{}' allowed {}",
                    self.size_filter.name(),
                    file_path.display()
                );
                Ok(())
            }
            Err(e) => {
                tracing::trace!("Size filter failed for {}: {}", file_path.display(), e);
                Ok(()) // Continue processing on filter error
            }
        }
    }

    /// Apply binary filter to a file path
    fn apply_binary_filter(&self, file_path: &Path) -> Result<()> {
        use super::filters::Filter;
        match self.binary_filter.filter(file_path) {
            Ok(super::filters::FilterDecision::Skip(reason)) => {
                tracing::trace!(
                    "Filter '{}' skipped {}: {}",
                    self.binary_filter.name(),
                    file_path.display(),
                    reason
                );
                super::counters::COUNT_DISCOVERY_BINARY_FILTERED
                    .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
                Err(anyhow::anyhow!("File skipped by binary filter"))
            }
            Ok(super::filters::FilterDecision::Process) => {
                tracing::trace!(
                    "Filter '{}' allowed {}",
                    self.binary_filter.name(),
                    file_path.display()
                );
                Ok(())
            }
            Err(e) => {
                tracing::trace!("Binary filter failed for {}: {}", file_path.display(), e);
                Ok(()) // Continue processing on filter error
            }
        }
    }

    /// Scan entire file content for secrets using optimized filter pipeline
    fn scan_content(
        &self,
        content: Arc<String>,
        file_path: Arc<PathBuf>,
    ) -> Result<Vec<SecretMatch>> {
        use super::filters::{
            Filter,
            content::{CommentFilterInput, RegexInput},
        };

        // Step 1: Aho-Corasick prefilter - eliminates ~85% of patterns before regex execution
        let prefilter_start = std::time::Instant::now();
        let active_patterns = self
            .prefilter
            .filter(&content)
            .context("Prefilter failed")?;
        let prefilter_duration = prefilter_start.elapsed();

        if active_patterns.is_empty() {
            tracing::trace!(
                "No active patterns for file {}, skipping regex execution",
                file_path.display()
            );
            return Ok(Vec::new());
        }

        tracing::trace!(
            "Filter '{}' found {} active patterns for file {} in {}",
            self.prefilter.name(),
            active_patterns.len(),
            file_path.display(),
            crate::shared::time::format_time(prefilter_duration)
        );

        // Step 2: Regex execution on pre-filtered patterns (~15% of original)
        let regex_input = RegexInput {
            content: content.clone(),     // Cheap Arc clone, no copy
            file_path: file_path.clone(), // Cheap Arc clone
            active_patterns,
        };

        let regex_start = std::time::Instant::now();
        let matches = self
            .regex_executor
            .filter(&regex_input)
            .context("Regex execution failed")?;
        let regex_duration = regex_start.elapsed();

        if matches.is_empty() {
            return Ok(Vec::new());
        }

        tracing::trace!(
            "Filter '{}' found {} matches for file {} in {}",
            self.regex_executor.name(),
            matches.len(),
            file_path.display(),
            crate::shared::time::format_time(regex_duration)
        );

        // Step 3: Apply entropy analysis if enabled
        let mut filtered_matches = Vec::new();
        if CONFIG.scanner.enable_entropy_analysis {
            for mut secret_match in matches {
                // Calculate and store entropy
                secret_match.entropy = super::entropy::calculate_randomness_probability(
                    secret_match.matched_text.as_bytes(),
                );

                // Use pattern-specific threshold or default
                let threshold = secret_match
                    .pattern
                    .entropy_threshold
                    .unwrap_or(CONFIG.scanner.entropy_threshold);

                // Use the comprehensive entropy analysis function
                if super::entropy::is_likely_secret(secret_match.matched_text.as_bytes(), threshold)
                {
                    filtered_matches.push(secret_match);
                } else {
                    tracing::trace!(
                        "Match '{}' [{}] failed entropy analysis (prob: {:.2e} < threshold: \
                         {:.2e}) in file {} at line {}",
                        secret_match.matched_text,
                        secret_match.pattern.name,
                        secret_match.entropy,
                        threshold,
                        file_path.display(),
                        secret_match.line_number
                    );
                }
            }
        } else {
            filtered_matches = matches;
        }

        if filtered_matches.is_empty() {
            return Ok(Vec::new());
        }

        // Step 4: Comment filter for guardy:ignore directives
        let comment_input = CommentFilterInput {
            matches: filtered_matches,
            file_content: content.clone(), // Cheap Arc clone, no copy
        };

        let comment_start = std::time::Instant::now();
        let final_matches = self
            .comment_filter
            .filter(&comment_input)
            .context("Comment filter failed")?;
        let comment_duration = comment_start.elapsed();

        tracing::trace!(
            "Filter '{}' processed {} matches for file {} in {}",
            self.comment_filter.name(),
            final_matches.len(),
            file_path.display(),
            crate::shared::time::format_time(comment_duration)
        );

        Ok(final_matches)
    }

    /// Display filter statistics for debugging and performance monitoring
    fn show_filter_stats(&self) {
        use super::filters::Filter;

        tracing::trace!("Filter Configuration and Statistics:");

        // Size filter stats
        for (key, value) in self.size_filter.get_stats() {
            tracing::trace!("  Size Filter - {}: {}", key, value);
        }

        // Binary filter stats
        for (key, value) in self.binary_filter.get_stats() {
            tracing::trace!("  Binary Filter - {}: {}", key, value);
        }

        // Content filter stats
        for (key, value) in self.prefilter.get_stats() {
            tracing::trace!("  Prefilter - {}: {}", key, value);
        }

        for (key, value) in self.regex_executor.get_stats() {
            tracing::trace!("  Regex Executor - {}: {}", key, value);
        }

        for (key, value) in self.comment_filter.get_stats() {
            tracing::trace!("  Comment Filter - {}: {}", key, value);
        }

        // Pattern library stats
        let (patterns_count, keywords_count) = super::counters::get_pattern_stats();
        tracing::trace!("  Pattern Library - Patterns loaded: {}", patterns_count);
        tracing::trace!("  Pattern Library - Keywords loaded: {}", keywords_count);
    }
}

#[cfg(test)]
mod tests {
    use std::fs;

    use tempfile::TempDir;

    use super::*;

    #[test]
    fn test_scanner_creation() {
        let scanner = Scanner::new();
        assert!(scanner.is_ok());
    }

    #[test]
    fn test_file_scanning() {
        let temp_dir = TempDir::new().unwrap();
        let test_file = temp_dir.path().join("test_secrets.txt");

        // Read test content from encrypted fixtures
        let fixtures_path = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("tests/fixtures/test_secrets.txt");
        let test_content = fs::read_to_string(fixtures_path)
            .expect("Failed to read test fixtures - ensure git-crypt is unlocked");

        fs::write(&test_file, test_content).unwrap();

        let scanner = Scanner::new().unwrap();
        let stats = scanner.scan(&[test_file]).unwrap();

        // Should find some secrets but filter out obvious fake ones with entropy analysis
        assert!(stats.total_matches > 0);

        // With streaming output, matches are printed during scanning
        println!(
            "Scan completed - found {} total matches",
            stats.total_matches
        );
    }

    // Removed test_scan_directory - was causing CI timeouts and will be replaced by scan2
    // implementation
}