#!/bin/sh
# Spendlight safety check: refuse any commit that would include real
# statements, databases or backups. Only made-up test files under a
# fixtures/synthetic/ folder may be CSV, OFX, QFX, QBO or Excel.
staged=$(git diff --cached --name-only --diff-filter=ACMR)
blocked=$(printf '%s\n' "$staged" \
  | grep -E -i '^(samples|data|backups)/|\.(csv|ofx|qfx|qbo|xls|xlsx|sqlite|sqlite3|db)$' \
  | grep -v -E '^samples/README\.md$|(^|/)fixtures/synthetic/' || true)
if [ -n "$blocked" ]; then
  echo "Commit blocked: these files look like real financial data." >&2
  printf '  %s\n' $blocked >&2
  echo "Statement files stay on the server. Test files belong in fixtures/synthetic/." >&2
  exit 1
fi