#!/usr/bin/env bash
# Search lockfiles for the Axios versions published on 31 March 2026.
# Reads files only. Does not run npm and does not contact a registry.
set -euo pipefail

root="${1:-.}"
if [[ ! -d "$root" ]]; then
  printf 'not a directory: %s\n' "$root" >&2
  exit 2
fi

pattern='axios@1\.14\.1|axios@0\.30\.4|"axios"[[:space:]]*:[[:space:]]*"1\.14\.1"|"axios"[[:space:]]*:[[:space:]]*"0\.30\.4"|plain-crypto-js'

hits=0
while IFS= read -r -d '' file; do
  if grep -nHE "$pattern" "$file"; then
    hits=1
  fi
done < <(find "$root" \( -type d \( -name .git -o -name .terraform \) -prune \) -o \( -type f \( \
  -name package-lock.json -o -name yarn.lock -o -name pnpm-lock.yaml -o -name pnpm-lock.yml \
  -o -name npm-shrinkwrap.json -o -name package.json \
  \) -print0 \))

if [[ "$hits" -eq 0 ]]; then
  printf 'clean: no axios 1.14.1, axios 0.30.4, or plain-crypto-js under %s\n' "$root"
  exit 0
fi

printf 'hit: a machine that installed these versions needs its secrets rotated from a different machine.\n'
exit 1