#!/bin/bash
echo "=== Certificate Renewal Security Tests ==="
echo ""

API_KEY="shopdb_pat_b4a3fe2a01abc6bc1cb685280e65a8c35d52ec43"
BASE_URL="https://localhost:5001"

echo "Test 1: Hostname Validation - Empty hostname"
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hostname":""}' \
  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"

echo "Test 2: Hostname Validation - SQL injection attempt"
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hostname":"test;DROP TABLE"}' \
  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"

echo "Test 3: Hostname Validation - Path traversal"
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hostname":"../../etc/passwd"}' \
  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"

echo "Test 4: Hostname Validation - Too long (65 chars)"
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hostname":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}' \
  -s -w "\nStatus: %{http_code}\n\n" | grep -E "error|Status"

echo "Test 5: Valid hostname (should work or rate limit)"
curl -k -X POST "$BASE_URL/api/endpoints/certificate/renew" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"hostname":"DESKTOP-HF1K9M4"}' \
  -s -w "\nStatus: %{http_code}\n" | head -20

echo ""
echo "=== Check Agent Cert Authentication ==="
docker-compose logs --tail=500 api 2>&1 | grep "Authenticated asset 2528" | tail -3