#!/bin/bash
# ==========================================================
# 8Core Scanner — Root log reader
# Pokreće se kao root via sudo od strane web panela.
# Prima samo: --type=core_scan|core_live|core_worker|core_cron --mode=preview|download [--id=N]
# NE prima filesystem putanje kao argumente.
# Exit: 0=uspješno, 1=argument/security/config greška, 2=log nije nađen/čitljiv, 3=nevaljan mode
# ==========================================================

ROOT_ENGINE_PATH="/root/8core_scanner"
CONFIG="${ROOT_ENGINE_PATH}/scanner-db.conf"
LOG_PATH="/root/8core_scanner/logs"

# Ako postoji root config i vlasnik je root, učitaj ga kao jedini izvor istine.
if [[ -f "$CONFIG" ]]; then
  CONF_OWNER=$(stat -c %u "$CONFIG" 2>/dev/null || echo "")
  if [[ "$CONF_OWNER" == "0" ]]; then
    # shellcheck disable=SC1090
    source "$CONFIG"
  else
    echo "CONFIG_OWNER_INVALID: $CONFIG nije root-owned" >&2
    exit 1
  fi
fi

ROOT_ENGINE_PATH="${ROOT_ENGINE_PATH:-/root/8core_scanner}"
LOG_PATH="${LOG_PATH:-${ROOT_ENGINE_PATH}/logs}"
LOG_PATH="${LOG_PATH%/}"

TYPE=""
MODE="preview"
SCAN_ID=""

for arg in "$@"; do
  case "$arg" in
    --type=*) TYPE="${arg#*=}" ;;
    --mode=*) MODE="${arg#*=}" ;;
    --id=*) SCAN_ID="${arg#*=}" ;;
    *) echo "UNKNOWN_ARGUMENT: $arg" >&2; exit 1 ;;
  esac
done

[[ -z "$TYPE" ]] && { echo "MISSING_ARGUMENT: --type" >&2; exit 1; }
case "$MODE" in preview|download) ;; *) echo "INVALID_MODE: $MODE" >&2; exit 3 ;; esac

case "$TYPE" in
  core_scan)
    [[ "$SCAN_ID" =~ ^[1-9][0-9]*$ ]] || { echo "INVALID_SCAN_ID" >&2; exit 1; }
    shopt -s nullglob
    SCAN_MATCHES=("${LOG_PATH}/scans/scan-${SCAN_ID}-"*.log)
    shopt -u nullglob
    [[ "${#SCAN_MATCHES[@]}" -gt 0 ]] || { echo "LOG_NOT_FOUND: scan_id=$SCAN_ID" >&2; exit 2; }
    [[ "${#SCAN_MATCHES[@]}" -eq 1 ]] || { echo "MULTIPLE_SCAN_LOGS: scan_id=$SCAN_ID" >&2; exit 1; }
    LOGFILE="${SCAN_MATCHES[0]}"
    EXPECTED_BASE="${LOG_PATH}/scans"
    ;;
  core_live)   LOGFILE="${LOG_PATH}/ioc-scan-live.log" ;;
  core_worker) LOGFILE="${LOG_PATH}/scanner-worker.log" ;;
  core_cron)   LOGFILE="${LOG_PATH}/scanner_worker_cron.log" ;;
  *) echo "UNKNOWN_LOG_TYPE: $TYPE" >&2; exit 1 ;;
esac

EXPECTED_BASE="${EXPECTED_BASE:-$LOG_PATH}"

NORM_BASE=$(realpath -m "$EXPECTED_BASE" 2>/dev/null || printf '%s' "$EXPECTED_BASE")
NORM_FILE=$(realpath -m "$LOGFILE" 2>/dev/null || printf '%s' "$LOGFILE")

case "$NORM_FILE" in
  "$NORM_BASE"|"$NORM_BASE"/*) ;;
  *) echo "LOG_PATH_SECURITY_FAIL: $NORM_FILE izvan $NORM_BASE" >&2; exit 1 ;;
esac

[[ -f "$NORM_FILE" ]] || { echo "LOG_NOT_FOUND: $NORM_FILE" >&2; exit 2; }
[[ -r "$NORM_FILE" ]] || { echo "LOG_NOT_READABLE: $NORM_FILE" >&2; exit 2; }

if [[ "$MODE" == "download" ]]; then
  cat -- "$NORM_FILE"
else
  tail -n 1000 -- "$NORM_FILE" | head -c 204800
fi
exit 0
