#!/bin/bash
# Quick security validation tests - Essential attacks that MUST be blocked

BASE_URL="http://localhost:4444"
TOKEN="Paste token here"


#########################################
# LOGGING HELPERS
#########################################

log_info()    { echo -e "\033[34mℹ️  INFO:\033[0m $1"; }
log_warn()    { echo -e "\033[33m⚠️  WARNING:\033[0m $1"; }
log_error()   { echo -e "\033[31m❌ ERROR:\033[0m $1"; }
log_ok()      { echo -e "\033[32m✔️  OK:\033[0m $1"; }

#########################################
# RESPONSE HELPERS
#########################################

extract_status() {
    echo "$1" | sed -n 's/.*HTTPSTATUS://p'
}

extract_body() {
    echo "$1" | sed 's/HTTPSTATUS:.*//'
}

call_api() {
    curl -s -w "HTTPSTATUS:%{http_code}" "$@"
}

check_result() {
    body="$1"

    # If any error/warning message appears → blocked correctly
    if echo "$body" | grep -Ei "error|value error|validation|failed|cannot|not allowed|invalid|html tags|directory traversal|metacharacters"; then
        log_ok "Attack BLOCKED as expected"
        return
    fi

    # Successful unsafe acceptance = BAD
    log_error "Should have been BLOCKED"
}


check_allowed() {
    if echo "$1" | grep -q "\"id\""; then
        log_ok "Allowed as expected"
    else
        log_error "Should have been ALLOWED"
    fi
}

#########################################
# START TESTING
#########################################

log_info "Starting Quick Security Tests"
echo "==================================="

#########################################
echo "🔒 Test 1: Path Traversal"
resp=$(call_api -X POST "$BASE_URL/resources" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "resource": {
      "uri": "../../../etc/passwd",
      "name": "test_traversal",
      "content": "dummy"
    },
    "team_id": null,
    "visibility": "private"
  }')

body=$(extract_body "$resp")
status=$(extract_status "$resp")

echo "$body" | jq .
log_info "HTTP Status: $status"
check_result "$body"
echo ""

#########################################
echo "🔒 Test 2: Shell Injection"
resp=$(call_api -X POST "$BASE_URL/tools" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tool": {"name": "test_shell", "description": "ls && cat /etc/passwd"}}')

body=$(extract_body "$resp")
status=$(extract_status "$resp")

echo "$body" | jq .
log_info "HTTP Status: $status"
check_result "$body"
echo ""

#########################################
echo "🔒 Test 3: SQL Injection"
resp=$(call_api -X POST "$BASE_URL/tools" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tool": {"name": "test_sql", "description": "'"'"'; DROP TABLE users; --"}}')

body=$(extract_body "$resp")
status=$(extract_status "$resp")

echo "$body" | jq .
log_info "HTTP Status: $status"
check_result "$body"
echo ""

#########################################
echo "🔒 Test 4: XSS"
resp=$(call_api -X POST "$BASE_URL/tools" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tool": {"name": "test_xss", "description": "<script>alert(1)</script>"}}')

body=$(extract_body "$resp")
status=$(extract_status "$resp")

echo "$body" | jq .
log_info "HTTP Status: $status"
check_result "$body"
echo ""

#########################################
echo "🔒 Test 5: Dangerous URL"
resp=$(call_api -X POST "$BASE_URL/tools" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tool": {"name": "test_url", "url": "javascript:alert(1)"}}')

body=$(extract_body "$resp")
status=$(extract_status "$resp")

echo "$body" | jq .
log_info "HTTP Status: $status"
check_result "$body"
echo ""

#########################################
echo "✅ Test 6: Safe Command"
resp=$(call_api -X POST "$BASE_URL/tools" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"tool\": {\"name\": \"safe_tool_$(date +%s)\", \"description\": \"echo hello world\"}}")

body=$(extract_body "$resp")
status=$(extract_status "$resp")

echo "$body" | jq .
log_info "HTTP Status: $status"
check_allowed "$body"
echo ""

log_info "🏁 All tests completed!"