#!/usr/bin/env bash
set -euo pipefail

BASE_URL="${BASE_URL:-https://wx.sstbc.com}"
CURL_TIMEOUT="${CURL_TIMEOUT:-20}"
CURL_RESOLVE="${CURL_RESOLVE:-}"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

CURL_ARGS=(-sS -L --max-time "$CURL_TIMEOUT")
if [[ "${CURL_INSECURE:-0}" == "1" ]]; then
    CURL_ARGS+=(-k)
fi
if [[ -n "$CURL_RESOLVE" ]]; then
    CURL_ARGS+=(--resolve "$CURL_RESOLVE")
fi

paths=(
    "/docs/"
    "/swagger/"
    "/swagger/json"
    "/api/documentation"
    "/docs/api-docs.json"
    "/docs/api-docs.yaml"
    "/swagger/index.html"
    "/swagger/swagger-ui.js"
    "/storage/api-docs/api-docs.json"
)

failed=0
for index in "${!paths[@]}"; do
    path="${paths[$index]}"
    body="$TMP_DIR/response-$index.body"
    status=""

    if ! status="$(curl "${CURL_ARGS[@]}" -o "$body" -w '%{http_code}' "$BASE_URL$path")"; then
        status="000"
    fi

    if [[ "$status" != "403" && "$status" != "404" ]]; then
        printf '%-38s HTTP %s FAIL\n' "$path" "$status"
        failed=1
        continue
    fi

    if grep -Eiq 'swagger|openapi|api-docs' "$body"; then
        printf '%-38s HTTP %s DOCUMENT_CONTENT_FAIL\n' "$path" "$status"
        failed=1
        continue
    fi

    printf '%-38s HTTP %s PASS\n' "$path" "$status"
done

if [[ "$failed" -ne 0 ]]; then
    exit 1
fi

printf 'VULN02_DOCUMENTATION_EXPOSURE PASS\n'