validate_code.sh

#!/usr/bin/env bash
# =============================================================================
# validate_code.sh — Lint, syntax-check, and run code files
# Usage: ./validate_code.sh <file> [--run] [--strict]
# =============================================================================

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

FILE="${1:-}"
RUN_FLAG="${2:-}"
STRICT_FLAG="${3:-}"
ERRORS=0
WARNINGS=0

if [[ -z "$FILE" ]]; then
    echo -e "${RED}Usage: validate_code.sh <file> [--run] [--strict]${NC}"
    exit 1
fi

if [[ ! -f "$FILE" ]]; then
    echo -e "${RED}[CRIT] File not found: $FILE${NC}"
    exit 1
fi

EXT="${FILE##*.}"
# Safe file size check
if command -v stat &>/dev/null; then
    if stat -f%z "$FILE" &>/dev/null; then
        FILESIZE=$(stat -f%z "$FILE") # BSD/macOS
    else
        FILESIZE=$(stat -c%s "$FILE") # GNU/Linux
    fi
else
    FILESIZE=$(wc -c < "$FILE" | tr -d ' ') # Fallback
fi

echo "============================================="
echo -e "${BLUE}QA Code Validator${NC}"
echo "============================================="
echo "File:      $FILE"
echo "Extension: $EXT"
echo "Size:      $FILESIZE bytes"
echo "============================================="
echo ""

# --- Check 1: File is not empty ---
if [[ "$FILESIZE" -eq 0 ]]; then
    echo -e "${RED}[CRIT-001] File is empty (0 bytes)${NC}"
    ERRORS=$((ERRORS + 1))
fi

# --- Check 2: No BOM marker ---
if head -c 3 "$FILE" | grep -qP '\xef\xbb\xbf' 2>/dev/null; then
    echo -e "${YELLOW}[WARN-001] File has UTF-8 BOM marker — may cause issues${NC}"
    WARNINGS=$((WARNINGS + 1))
fi

# --- Check 3: No trailing whitespace ---
if grep -Pn '\s+$' "$FILE" > /dev/null 2>&1; then
    TRAILING_COUNT=$(grep -Pc '\s+$' "$FILE" 2>/dev/null || echo "0")
    echo -e "${YELLOW}[WARN-002] Trailing whitespace on $TRAILING_COUNT line(s)${NC}"
    WARNINGS=$((WARNINGS + 1))
fi

# --- Check 4: No debug/TODO markers ---
DEBUG_PATTERNS='console\.log\(|print\(.*debug|TODO|FIXME|HACK|XXX|TEMP|DELETEME'
if grep -PIn "$DEBUG_PATTERNS" "$FILE" > /dev/null 2>&1; then
    echo -e "${YELLOW}[WARN-003] Debug/TODO markers found:${NC}"
    grep -PIn "$DEBUG_PATTERNS" "$FILE" | head -10
    WARNINGS=$((WARNINGS + 1))
fi

# --- Check 5: No hardcoded secrets ---
SECRET_PATTERNS='password\s*=\s*["\x27].+|api_key\s*=\s*["\x27].+|secret\s*=\s*["\x27].+|token\s*=\s*["\x27][A-Za-z0-9]+'
if grep -PIn "$SECRET_PATTERNS" "$FILE" > /dev/null 2>&1; then
    echo -e "${RED}[CRIT-002] Possible hardcoded secrets found:${NC}"
    grep -PIn "$SECRET_PATTERNS" "$FILE" | head -5
    ERRORS=$((ERRORS + 1))
fi

# --- Language-specific checks ---
case "$EXT" in

    py)
        echo -e "\n${BLUE}--- Python Checks ---${NC}"

        # Syntax check - prevent code execution during compile
        if python3 -m py_compile "$FILE" 2>/dev/null; then
             echo -e "${GREEN}[PASS] Python syntax OK${NC}"
        else
            echo -e "${RED}[CRIT-003] Python syntax error${NC}"
            python3 -m py_compile "$FILE" 2>&1 || true
            ERRORS=$((ERRORS + 1))
        fi

        # Check imports are available (static analysis only)
        echo -e "\n${BLUE}Checking imports...${NC}"
        IMPORTS=$(grep -P '^\s*(import|from)\s+' "$FILE" | sed 's/^\s*import\s\+//' | sed 's/^\s*from\s\+//' | cut -d' ' -f1 | cut -d'.' -f1 | sort -u)
        for mod in $IMPORTS; do
            # Secure import check: don't actually import the file, checking stdlib/site-packages
            if python3 -c "import importlib.util, sys; sys.exit(0 if importlib.util.find_spec('$mod') else 1)" 2>/dev/null; then
                echo -e "  ${GREEN}✓ $mod${NC}"
            else
                echo -e "  ${RED}✗ $mod — NOT INSTALLED${NC}"
                ERRORS=$((ERRORS + 1))
            fi
        done

        # Run if requested
        if [[ "$RUN_FLAG" == "--run" ]]; then
            echo -e "\n${BLUE}Running file...${NC}"
            # Use timeout if available
            if command -v timeout &>/dev/null; then
                timeout 30 python3 "$FILE" 2>&1 && echo -e "${GREEN}[PASS] Execution succeeded${NC}" || {
                    echo -e "${RED}[CRIT-004] Execution failed${NC}"
                    ERRORS=$((ERRORS + 1))
                }
            else
                 python3 "$FILE" 2>&1 && echo -e "${GREEN}[PASS] Execution succeeded${NC}" || {
                    echo -e "${RED}[CRIT-004] Execution failed${NC}"
                    ERRORS=$((ERRORS + 1))
                }
            fi
        fi
        ;;

    js|mjs|cjs)
        echo -e "\n${BLUE}--- JavaScript Checks ---${NC}"

        # Syntax check with Node
        if command -v node &>/dev/null; then
            if node --check "$FILE" 2>/dev/null; then
                echo -e "${GREEN}[PASS] JavaScript syntax OK${NC}"
            else
                echo -e "${RED}[CRIT-003] JavaScript syntax error${NC}"
                node --check "$FILE" 2>&1 || true
                ERRORS=$((ERRORS + 1))
            fi
        else
            echo -e "${YELLOW}[WARN] Node.js not available for syntax check${NC}"
            WARNINGS=$((WARNINGS + 1))
        fi

        # Run if requested
        if [[ "$RUN_FLAG" == "--run" ]]; then
            echo -e "\n${BLUE}Running file...${NC}"
             if command -v timeout &>/dev/null; then
                timeout 30 node "$FILE" 2>&1 && echo -e "${GREEN}[PASS] Execution succeeded${NC}" || {
                    echo -e "${RED}[CRIT-004] Execution failed${NC}"
                    ERRORS=$((ERRORS + 1))
                }
            else
                node "$FILE" 2>&1 && echo -e "${GREEN}[PASS] Execution succeeded${NC}" || {
                    echo -e "${RED}[CRIT-004] Execution failed${NC}"
                    ERRORS=$((ERRORS + 1))
                }
            fi
        fi
        ;;

    ts|tsx)
        echo -e "\n${BLUE}--- TypeScript Checks ---${NC}"
        if command -v npx &>/dev/null && npx tsc --version &>/dev/null 2>&1; then
            npx tsc --noEmit --strict "$FILE" 2>&1 && echo -e "${GREEN}[PASS] TypeScript compiles${NC}" || {
                echo -e "${RED}[CRIT-003] TypeScript compilation errors${NC}"
                ERRORS=$((ERRORS + 1))
            }
        else
            echo -e "${YELLOW}[WARN] TypeScript compiler not available${NC}"
            WARNINGS=$((WARNINGS + 1))
        fi
        ;;

    sh|bash)
        echo -e "\n${BLUE}--- Shell Script Checks ---${NC}"

        # Syntax check
        if bash -n "$FILE" 2>/dev/null; then
            echo -e "${GREEN}[PASS] Shell syntax OK${NC}"
        else
            echo -e "${RED}[CRIT-003] Shell syntax error${NC}"
            bash -n "$FILE" 2>&1 || true
            ERRORS=$((ERRORS + 1))
        fi

        # Shellcheck if available
        if command -v shellcheck &>/dev/null; then
            ISSUES=$(shellcheck "$FILE" 2>&1 | grep -c 'SC[0-9]' || true)
            if [[ "$ISSUES" -gt 0 ]]; then
                echo -e "${YELLOW}[WARN] ShellCheck found $ISSUES issue(s)${NC}"
                shellcheck "$FILE" 2>&1 | head -20
                WARNINGS=$((WARNINGS + 1))
            else
                echo -e "${GREEN}[PASS] ShellCheck clean${NC}"
            fi
        fi

        # Check shebang
        if ! head -1 "$FILE" | grep -q '^#!'; then
            echo -e "${YELLOW}[WARN-004] Missing shebang line${NC}"
            WARNINGS=$((WARNINGS + 1))
        fi

        # Check executable permission
        if [[ ! -x "$FILE" ]]; then
            echo -e "${YELLOW}[WARN-005] File is not executable (chmod +x)${NC}"
            WARNINGS=$((WARNINGS + 1))
        fi
        ;;

    html|htm)
        echo -e "\n${BLUE}--- HTML Checks ---${NC}"

        # Basic structure check
        if grep -qi '<html' "$FILE" && grep -qi '</html>' "$FILE"; then
            echo -e "${GREEN}[PASS] Has <html> tags${NC}"
        else
            echo -e "${RED}[CRIT-003] Missing <html> structure${NC}"
            ERRORS=$((ERRORS + 1))
        fi

        if grep -qi '<head' "$FILE"; then
            echo -e "${GREEN}[PASS] Has <head> section${NC}"
        else
            echo -e "${YELLOW}[WARN] Missing <head> section${NC}"
            WARNINGS=$((WARNINGS + 1))
        fi

        if grep -qi '<body' "$FILE"; then
            echo -e "${GREEN}[PASS] Has <body> section${NC}"
        else
            echo -e "${RED}[CRIT-004] Missing <body> section${NC}"
            ERRORS=$((ERRORS + 1))
        fi
        ;;

    json)
        echo -e "\n${BLUE}--- JSON Checks ---${NC}"
        if python3 -c "import json, sys; json.load(open(sys.argv[1]))" "$FILE" 2>/dev/null; then
            echo -e "${GREEN}[PASS] Valid JSON${NC}"
        else
            echo -e "${RED}[CRIT-003] Invalid JSON${NC}"
            python3 -c "import json, sys; json.load(open(sys.argv[1]))" "$FILE" 2>&1 || true
            ERRORS=$((ERRORS + 1))
        fi
        ;;

    css)
        echo -e "\n${BLUE}--- CSS Checks ---${NC}"
        # Check for unclosed braces
        OPEN_BRACES=$(grep -o '{' "$FILE" | wc -l)
        CLOSE_BRACES=$(grep -o '}' "$FILE" | wc -l)
        if [[ "$OPEN_BRACES" -eq "$CLOSE_BRACES" ]]; then
            echo -e "${GREEN}[PASS] Braces balanced ($OPEN_BRACES pairs)${NC}"
        else
            echo -e "${RED}[CRIT-003] Unbalanced braces: $OPEN_BRACES open, $CLOSE_BRACES close${NC}"
            ERRORS=$((ERRORS + 1))
        fi
        ;;

    *)
        echo -e "${YELLOW}[INFO] No language-specific checks for .$EXT files${NC}"
        ;;
esac

# --- Summary ---
echo ""
echo "============================================="
echo -e "${BLUE}VALIDATION SUMMARY${NC}"
echo "============================================="
echo -e "Errors:   ${RED}$ERRORS${NC}"
echo -e "Warnings: ${YELLOW}$WARNINGS${NC}"

if [[ "$ERRORS" -gt 0 ]]; then
    echo -e "\n${RED}❌ VERDICT: FAIL — $ERRORS critical issue(s) found${NC}"
    exit 1
elif [[ "$WARNINGS" -gt 0 && "$STRICT_FLAG" == "--strict" ]]; then
    echo -e "\n${YELLOW}⚠️  VERDICT: FAIL (strict mode) — $WARNINGS warning(s)${NC}"
    exit 1
elif [[ "$WARNINGS" -gt 0 ]]; then
    echo -e "\n${YELLOW}⚠️  VERDICT: PASS WITH WARNINGS — $WARNINGS warning(s)${NC}"
    exit 0
else
    echo -e "\n${GREEN}✅ VERDICT: PASS — All checks passed${NC}"
    exit 0
fi