package main

func init() {
	register(Check{
		Seq:   10,
		ID:    "1",
		Title: "Secret env var reads outside config.Load()",
		Run: func(ctx *ScanContext, rep *Reporter) {
			var envViolations []envViolation
			for _, target := range ctx.backendTargets {
				for _, v := range checkEnvReads(target.root) {
					v.file = prefixDisplayPath(target.display, v.file)
					envViolations = append(envViolations, v)
				}
			}
			for _, target := range ctx.pluginTargets {
				for _, v := range checkEnvReads(target.root) {
					v.file = prefixDisplayPath(target.display, v.file)
					envViolations = append(envViolations, v)
				}
			}
			if len(envViolations) > 0 {
				rep.Fail("%d secret env var read(s) outside config.Load() — secrets must flow through Config → DI", len(envViolations))
				for _, v := range envViolations {
					rep.Findingf("%s:%d os.Getenv(%q)", v.file, v.line, v.envVar)
				}
			} else {
				if len(ctx.pluginTargets) > 0 {
					rep.OK("No secret env var reads outside config.Load() (%d plugin roots scanned)", len(ctx.pluginTargets))
				} else {
					rep.OK("No secret env var reads outside config.Load()")
				}
			}
		},
	})
}