#!/bin/bash
#
# Security Test Suite for Contact Form
# Tests all security features against a live server
#
# Usage:
#   ./security_tests.sh [SERVER_URL]
#
# Example:
#   ./security_tests.sh http://localhost:8080
#   ./security_tests.sh https://cv.example.com
#

set -e  # Exit on error

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Server URL (default to localhost)
SERVER_URL="${1:-http://localhost:8080}"
API_URL="${SERVER_URL}/api/contact"

# Test counters
TOTAL_TESTS=0
PASSED_TESTS=0
FAILED_TESTS=0

# Helper functions
print_header() {
    echo ""
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
    echo -e "${BLUE}$1${NC}"
    echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
}

print_test() {
    echo -e "${YELLOW}→ $1${NC}"
}

print_pass() {
    echo -e "${GREEN}✓ $1${NC}"
    ((PASSED_TESTS++))
}

print_fail() {
    echo -e "${RED}✗ $1${NC}"
    ((FAILED_TESTS++))
}

test_result() {
    local test_name="$1"
    local expected_code="$2"
    local actual_code="$3"
    local response="$4"

    ((TOTAL_TESTS++))

    if [ "$actual_code" -eq "$expected_code" ]; then
        print_pass "$test_name (expected $expected_code, got $actual_code)"
        return 0
    else
        print_fail "$test_name (expected $expected_code, got $actual_code)"
        echo "    Response: ${response:0:200}"
        return 1
    fi
}

# Calculate submit time (5 seconds ago)
get_submit_time() {
    echo $(( $(date +%s) * 1000 - 5000 ))
}

# Get submit time that's too fast (500ms ago)
get_fast_submit_time() {
    echo $(( $(date +%s) * 1000 - 500 ))
}

# Check if server is running
check_server() {
    print_header "Checking Server Availability"

    if curl -s -o /dev/null -w "%{http_code}" "$SERVER_URL" > /dev/null 2>&1; then
        print_pass "Server is running at $SERVER_URL"
        return 0
    else
        print_fail "Server is not accessible at $SERVER_URL"
        echo "Please start the server first: go run main.go"
        exit 1
    fi
}

# Test 1: Browser-Only Middleware - Block curl
test_block_curl() {
    print_header "Test 1: Browser-Only Middleware - Block HTTP Clients"

    # Test curl (default user agent)
    print_test "Testing curl blocking"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block curl" 403 "$http_code" "$body"

    # Test wget user agent
    print_test "Testing wget blocking"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Wget/1.20.3" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block wget" 403 "$http_code" "$body"

    # Test postman
    print_test "Testing Postman blocking"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: PostmanRuntime/7.26.8" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block Postman" 403 "$http_code" "$body"

    # Test python requests
    print_test "Testing Python requests blocking"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: python-requests/2.25.1" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block Python requests" 403 "$http_code" "$body"

    # Test empty user agent
    print_test "Testing empty User-Agent blocking"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent:" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block empty User-Agent" 403 "$http_code" "$body"
}

# Test 2: Browser-Only Middleware - Require Referer/Origin
test_require_referer_origin() {
    print_header "Test 2: Browser-Only Middleware - Referer/Origin Headers"

    # Test without Referer or Origin
    print_test "Testing request without Referer/Origin (should block)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "HX-Request: true" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block without Referer/Origin" 403 "$http_code" "$body"

    # Test with Referer
    print_test "Testing request with Referer (should allow)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message here&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Allow with Referer" 200 "$http_code" "$body"

    # Test with Origin
    print_test "Testing request with Origin (should allow)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "Origin: ${SERVER_URL}" \
        -H "HX-Request: true" \
        -d "email=test2@example.com&name=Test2&subject=Test&message=Another test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Allow with Origin" 200 "$http_code" "$body"
}

# Test 3: Browser-Only Middleware - Require Browser Headers
test_require_browser_headers() {
    print_header "Test 3: Browser-Only Middleware - Browser Headers"

    # Test without browser headers
    print_test "Testing request without browser headers (should block)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "Referer: ${SERVER_URL}/" \
        -d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Block without browser headers" 403 "$http_code" "$body"

    # Test with HX-Request header
    print_test "Testing request with HX-Request header (should allow)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=test3@example.com&name=Test3&subject=Test&message=Message with HX header&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Allow with HX-Request" 200 "$http_code" "$body"

    # Test with X-Requested-With header
    print_test "Testing request with X-Requested-With header (should allow)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "Referer: ${SERVER_URL}/" \
        -H "X-Requested-With: XMLHttpRequest" \
        -d "email=test4@example.com&name=Test4&subject=Test&message=Message with XMLHttpRequest header&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Allow with X-Requested-With" 200 "$http_code" "$body"

    # Test with X-Browser-Request header
    print_test "Testing request with X-Browser-Request header (should allow)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
        -H "Referer: ${SERVER_URL}/" \
        -H "X-Browser-Request: true" \
        -d "email=test5@example.com&name=Test5&subject=Test&message=Message with browser request header&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Allow with X-Browser-Request" 200 "$http_code" "$body"
}

# Test 4: Input Validation - Email Format
test_email_validation() {
    print_header "Test 4: Input Validation - Email Format"

    # Valid email
    print_test "Testing valid email"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=valid@example.com&name=Test&subject=Test&message=Valid email test message&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Valid email accepted" 200 "$http_code" "$body"

    # Invalid email - no @
    print_test "Testing invalid email (no @)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=notanemail&name=Test&subject=Test&message=Invalid email test&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Invalid email rejected (no @)" 400 "$http_code" "$body"

    # Invalid email - no domain
    print_test "Testing invalid email (no domain)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=test@&name=Test&subject=Test&message=Invalid email test&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Invalid email rejected (no domain)" 400 "$http_code" "$body"

    # Empty email
    print_test "Testing empty email"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=&name=Test&subject=Test&message=Empty email test&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Empty email rejected" 400 "$http_code" "$body"
}

# Test 5: Input Validation - Message Length
test_message_validation() {
    print_header "Test 5: Input Validation - Message Length"

    # Valid message
    print_test "Testing valid message length"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=test@example.com&name=Test&subject=Test&message=This is a valid message with sufficient length.&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Valid message accepted" 200 "$http_code" "$body"

    # Empty message
    print_test "Testing empty message"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=test@example.com&name=Test&subject=Test&message=&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Empty message rejected" 400 "$http_code" "$body"

    # Too long message (> 5000 chars)
    print_test "Testing message too long (>5000 chars)"
    long_message=$(printf 'a%.0s' {1..5001})
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=test@example.com&name=Test&subject=Test&message=${long_message}&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Too long message rejected" 400 "$http_code" "$body"
}

# Test 6: Bot Protection - Honeypot
test_honeypot() {
    print_header "Test 6: Bot Protection - Honeypot Field"

    # Honeypot empty (human)
    print_test "Testing honeypot empty (human behavior)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=human@example.com&name=Human&subject=Test&message=I am a real human user.&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Honeypot empty - accepted" 200 "$http_code" "$body"

    # Honeypot filled (bot)
    print_test "Testing honeypot filled (bot behavior)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=bot@example.com&name=Bot&subject=Spam&message=This is spam!&website=http://spam-site.com&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    # Honeypot returns 200 to fool bots, but doesn't actually send email
    test_result "Honeypot filled - fake success (bot fooled)" 200 "$http_code" "$body"
}

# Test 7: Bot Protection - Timing
test_timing_validation() {
    print_header "Test 7: Bot Protection - Form Submission Timing"

    # Valid timing (5 seconds)
    print_test "Testing normal submission timing (5 seconds)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=slow@example.com&name=Slow&subject=Test&message=I took my time filling this out.&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Normal timing accepted" 200 "$http_code" "$body"

    # Too fast (< 2 seconds)
    print_test "Testing fast submission (< 2 seconds)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=fast@example.com&name=Fast&subject=Test&message=I submitted instantly!&website=&submit_time=$(get_fast_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Too fast submission rejected" 400 "$http_code" "$body"
}

# Test 8: Rate Limiting
test_rate_limiting() {
    print_header "Test 8: Rate Limiting (5 requests per hour)"

    echo "Sending 6 requests rapidly..."

    for i in {1..6}; do
        print_test "Request #$i"
        response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -H "User-Agent: Mozilla/5.0" \
            -H "Referer: ${SERVER_URL}/" \
            -H "HX-Request: true" \
            -d "email=rate${i}@example.com&name=RateTest${i}&subject=Test&message=Rate limit test message number ${i}.&website=&submit_time=$(get_submit_time)")
        http_code=$(echo "$response" | tail -n1)
        body=$(echo "$response" | head -n-1)

        if [ "$i" -le 5 ]; then
            # First 5 should succeed
            test_result "Request $i allowed" 200 "$http_code" "$body"
        else
            # 6th should be rate limited
            test_result "Request $i rate limited" 429 "$http_code" "$body"
        fi

        # Small delay between requests
        sleep 0.1
    done

    echo ""
    echo -e "${YELLOW}Note: Rate limit resets after 1 hour${NC}"
}

# Test 9: Real-World Attack Scenarios
test_attack_scenarios() {
    print_header "Test 9: Real-World Attack Scenarios"

    # Scenario 1: Sophisticated bot with browser-like headers but honeypot filled
    print_test "Scenario 1: Sophisticated bot (browser headers + honeypot)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=smartbot@example.com&name=SmartBot&subject=Offer&message=Check out our amazing product!&website=http://smart-bot.com&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Smart bot caught by honeypot" 200 "$http_code" "$body"

    # Scenario 2: Script kiddie with curl
    print_test "Scenario 2: Script kiddie using curl"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -d "email=hacker@example.com&name=Hacker&subject=Pwned&message=You got hacked!&website=&submit_time=$(get_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Script kiddie blocked by BrowserOnly" 403 "$http_code" "$body"

    # Scenario 3: Automated form filler (fast submission)
    print_test "Scenario 3: Automated form filler (too fast)"
    response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "User-Agent: Mozilla/5.0" \
        -H "Referer: ${SERVER_URL}/" \
        -H "HX-Request: true" \
        -d "email=autobot@example.com&name=AutoBot&subject=Auto&message=Automatically filled form!&website=&submit_time=$(get_fast_submit_time)")
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | head -n-1)
    test_result "Auto-filler caught by timing check" 400 "$http_code" "$body"
}

# Summary
print_summary() {
    print_header "Test Summary"

    echo ""
    echo -e "Total Tests:  ${BLUE}${TOTAL_TESTS}${NC}"
    echo -e "Passed:       ${GREEN}${PASSED_TESTS}${NC}"
    echo -e "Failed:       ${RED}${FAILED_TESTS}${NC}"
    echo ""

    if [ "$FAILED_TESTS" -eq 0 ]; then
        echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
        echo -e "${GREEN}✓ ALL SECURITY TESTS PASSED!${NC}"
        echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
        exit 0
    else
        echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
        echo -e "${RED}✗ SOME TESTS FAILED${NC}"
        echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
        exit 1
    fi
}

# Main execution
main() {
    clear
    echo -e "${BLUE}"
    echo "╔══════════════════════════════════════════════════════════════════════╗"
    echo "║                                                                      ║"
    echo "║          CONTACT FORM SECURITY TEST SUITE                           ║"
    echo "║                                                                      ║"
    echo "╚══════════════════════════════════════════════════════════════════════╝"
    echo -e "${NC}"
    echo ""
    echo "Server: $SERVER_URL"
    echo "Endpoint: $API_URL"
    echo ""

    check_server
    test_block_curl
    test_require_referer_origin
    test_require_browser_headers
    test_email_validation
    test_message_validation
    test_honeypot
    test_timing_validation
    test_rate_limiting
    test_attack_scenarios
    print_summary
}

# Run main
main