#!/usr/bin/env bash
# Vector 21: Nuclei — Real CVE Detection
# Desc: Runs nuclei templates against discovered endpoints to find real CVEs
# Detect: Any target with reachable endpoints
# Severity: CRITICAL
# Tools: nuclei

vector_nuclei() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local findings=0
  
  print_info "Running Nuclei — real CVE detection..."
  
  if ! command -v nuclei &>/dev/null; then
    print_skip "nuclei not installed. Skipping CVE scanning."
    return 0
  fi
  
  # Check nuclei templates exist
  if [ ! -d "$HOME/nuclei-templates" ] && [ ! -d "/root/nuclei-templates" ]; then
    print_warn "Nuclei templates not found. Updating..."
    nuclei -update-templates 2>/dev/null | tail -1
  fi
  
  # Nuclei output file
  local nuclei_out="$REPORTS_DIR/.${domain}_nuclei.json"
  
  print_sub "Scanning with nuclei (severity: critical, high, medium)..."
  print_info "This may take 1-3 minutes..."
  
  # Run nuclei with focused templates
  nuclei -u "$target" \
    -severity critical,high,medium \
    -json \
    -o "$nuclei_out" \
    -rate-limit 50 \
    -concurrency 10 \
    -timeout 8 \
    -retries 1 \
    -silent 2>/dev/null &
  
  local nuclei_pid=$!
  
  # Show spinner while waiting
  local waited=0
  while kill -0 $nuclei_pid 2>/dev/null; do
    sleep 2
    waited=$((waited + 2))
    if [ $waited -ge 120 ]; then
      print_warn "Nuclei timeout (2min), killing..."
      kill $nuclei_pid 2>/dev/null
      break
    fi
  done
  
  wait $nuclei_pid 2>/dev/null
  
  # Parse results
  if [ -f "$nuclei_out" ] && [ -s "$nuclei_out" ]; then
    local vuln_count=$(wc -l < "$nuclei_out" | tr -d ' ')
    
    if [ "$vuln_count" -gt 0 ]; then
      print_find "Nuclei found $vuln_count vulnerabilities!"
      
      while IFS= read -r line; do
        [ -z "$line" ] && continue
        
        local template=$(echo "$line" | jq -r '.templateID // "unknown"' 2>/dev/null)
        local name=$(echo "$line" | jq -r '.info.name // "Unknown"' 2>/dev/null)
        local severity=$(echo "$line" | jq -r '.info.severity // "unknown"' 2>/dev/null)
        local matched=$(echo "$line" | jq -r '.matched // ""' 2>/dev/null)
        local curl_cmd=$(echo "$line" | jq -r '.curl-command // ""' 2>/dev/null)
        local extract=$(echo "$line" | jq -r '.extracted-results // [] | join(", ")' 2>/dev/null)
        
        local sev_upper=$(echo "$severity" | tr '[:lower:]' '[:upper:]')
        
        # Save finding
        echo "SEVERITY: $sev_upper
VECTOR: Nuclei - $template
DETAIL: $name on $matched
EVIDENCE: $extract
EXPLOIT: $curl_cmd" > "$REPORTS_DIR/.finding_$(date +%s)_nuclei-${template}.txt"
        
        findings=$((findings + 1))
        
        # Print to screen
        case "$severity" in
          critical) echo -e "    ${BRIGHT_RED}🔴 [CRITICAL]${NC} $name" ;;
          high)     echo -e "    ${RED}🟠 [HIGH]${NC} $name" ;;
          medium)   echo -e "    ${YELLOW}🟡 [MEDIUM]${NC} $name" ;;
          *)        echo -e "    ${BLUE}🔵 [$severity]${NC} $name" ;;
        esac
        [ -n "$matched" ] && echo -e "    ${DIM}     $matched${NC}"
        
      done < "$nuclei_out"
    else
      print_ok "Nuclei found no vulnerabilities"
    fi
  else
    print_ok "Nuclei found no vulnerabilities"
  fi
  
  return $findings
}