#!/usr/bin/env sh
set -eu

command_exists() {
  command -v "$1" >/dev/null 2>&1
}

to_b64() {
  if command_exists base64; then
    base64 | tr -d '\n'
  elif command_exists openssl; then
    openssl base64 -A
  else
    cat
  fi
}

capture() {
  sh -c "$1" 2>/dev/null | head -n 180
}

line() {
  printf '%s=%s\n' "$1" "$2"
}

HOSTNAME_VALUE="$(hostname 2>/dev/null || uname -n || echo unknown)"
FQDN_VALUE="$(hostname -f 2>/dev/null || echo "$HOSTNAME_VALUE")"
NOW_UTC="$(date -u +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null || date)"

OS_INFO="$(capture "uname -a; if [ -f /etc/os-release ]; then cat /etc/os-release; fi")"
KERNEL_INFO="$(capture "uname -r")"
UPTIME_INFO="$(capture "uptime; who -b 2>/dev/null || true")"

SSHD_CONFIG="$(capture "if [ -f /etc/ssh/sshd_config ]; then grep -Ei '^[[:space:]]*(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|ChallengeResponseAuthentication|X11Forwarding|AllowTcpForwarding)' /etc/ssh/sshd_config; else echo sshd_config_not_found; fi")"
FIREWALL_INFO="$(capture "if command -v ufw >/dev/null 2>&1; then ufw status; elif command -v firewall-cmd >/dev/null 2>&1; then firewall-cmd --state; elif command -v iptables >/dev/null 2>&1; then iptables -S; else echo firewall_tool_not_found; fi")"
FAIL2BAN_INFO="$(capture "if command -v systemctl >/dev/null 2>&1; then systemctl is-active fail2ban || true; elif command -v service >/dev/null 2>&1; then service fail2ban status || true; else echo service_manager_not_found; fi")"
PORTS_INFO="$(capture "if command -v ss >/dev/null 2>&1; then ss -tuln; elif command -v netstat >/dev/null 2>&1; then netstat -tuln; else echo socket_tool_not_found; fi")"
UPDATES_INFO="$(capture "if command -v apt >/dev/null 2>&1; then apt list --upgradable 2>/dev/null; elif command -v dnf >/dev/null 2>&1; then dnf check-update 2>/dev/null; elif command -v yum >/dev/null 2>&1; then yum check-update 2>/dev/null; else echo package_manager_not_found; fi")"

ENV_FILES_INFO="$(capture "found=0; for d in /var/www /srv/www /usr/share/nginx/html /opt; do [ -d \"\$d\" ] || continue; for f in \$(find \"\$d\" -maxdepth 5 -type f -name '.env' 2>/dev/null | head -n 25); do found=1; ls -ld \"\$f\" 2>/dev/null || echo \"\$f\"; done; done; if [ \"\$found\" -eq 0 ]; then echo env_files_not_found; fi")"
GIT_DIRS_INFO="$(capture "found=0; for d in /var/www /srv/www /usr/share/nginx/html /opt; do [ -d \"\$d\" ] || continue; for f in \$(find \"\$d\" -maxdepth 5 -type d -name '.git' 2>/dev/null | head -n 25); do found=1; ls -ld \"\$f\" 2>/dev/null || echo \"\$f\"; done; done; if [ \"\$found\" -eq 0 ]; then echo git_dirs_not_found; fi")"
WORLD_WRITABLE_INFO="$(capture "found=0; for f in \$(find /etc /var/www /srv/www /opt -xdev -type f -perm -0002 2>/dev/null | head -n 40); do found=1; ls -ld \"\$f\" 2>/dev/null || echo \"\$f\"; done; if [ \"\$found\" -eq 0 ]; then echo world_writable_not_found; fi")"
SUID_INFO="$(capture "found=0; for f in \$(find /usr/bin /bin /usr/sbin /sbin -xdev -type f \\\\( -perm -4000 -o -perm -2000 \\\\) 2>/dev/null | head -n 80); do found=1; ls -ld \"\$f\" 2>/dev/null || echo \"\$f\"; done; if [ \"\$found\" -eq 0 ]; then echo suid_sgid_not_found; fi")"
SERVICE_VERSIONS="$(capture "if command -v nginx >/dev/null 2>&1; then nginx -v 2>&1; fi; if command -v apache2 >/dev/null 2>&1; then apache2 -v 2>/dev/null | head -n 2; fi; if command -v httpd >/dev/null 2>&1; then httpd -v 2>/dev/null | head -n 2; fi; if command -v openssl >/dev/null 2>&1; then openssl version; fi; if command -v mysql >/dev/null 2>&1; then mysql --version; fi; if command -v psql >/dev/null 2>&1; then psql --version; fi")"
NOTES_INFO="Run generated by guardscanner-agent.sh. Review findings in the GuardScanner app."

line "GS_REPORT_TYPE" "guardscanner_server_agent_v2"
line "GS_AGENT_VERSION" "1.1.0"
line "GS_GENERATED_AT" "$NOW_UTC"
line "GS_HOSTNAME" "$HOSTNAME_VALUE"
line "GS_HOSTNAME_FQDN" "$FQDN_VALUE"
line "GS_OS_B64" "$(printf '%s' "$OS_INFO" | to_b64)"
line "GS_KERNEL_B64" "$(printf '%s' "$KERNEL_INFO" | to_b64)"
line "GS_UPTIME_B64" "$(printf '%s' "$UPTIME_INFO" | to_b64)"
line "GS_SSHD_CONFIG_B64" "$(printf '%s' "$SSHD_CONFIG" | to_b64)"
line "GS_FIREWALL_B64" "$(printf '%s' "$FIREWALL_INFO" | to_b64)"
line "GS_FAIL2BAN_B64" "$(printf '%s' "$FAIL2BAN_INFO" | to_b64)"
line "GS_PORTS_B64" "$(printf '%s' "$PORTS_INFO" | to_b64)"
line "GS_UPDATES_B64" "$(printf '%s' "$UPDATES_INFO" | to_b64)"
line "GS_ENV_FILES_B64" "$(printf '%s' "$ENV_FILES_INFO" | to_b64)"
line "GS_GIT_DIRS_B64" "$(printf '%s' "$GIT_DIRS_INFO" | to_b64)"
line "GS_WORLD_WRITABLE_B64" "$(printf '%s' "$WORLD_WRITABLE_INFO" | to_b64)"
line "GS_SUID_SGID_B64" "$(printf '%s' "$SUID_INFO" | to_b64)"
line "GS_SERVICE_VERSIONS_B64" "$(printf '%s' "$SERVICE_VERSIONS" | to_b64)"
line "GS_NOTES_B64" "$(printf '%s' "$NOTES_INFO" | to_b64)"