#!/usr/bin/env bash
# The Analyzer - Reconnaissance Engine
# Gathers target info for Ollama to make decisions

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../lib/utils.sh"

recon_target() {
  local target="$1"
  local domain=$(get_domain "$target")
  local report="$2"
  
  echo ""
  print_info "Gathering intelligence on $target..."
  separator
  
  RECON_DATA="Target: $target\nDomain: $domain\n"
  
  # 1. HTTP Status + Headers
  print_sub "Checking HTTP response..."
  local status=$(http_check "$target")
  local headers=$(get_headers "$target")
  local server=$(echo "$headers" | grep -i '^server:' | sed 's/[Ss]erver: //' | tr -d '\r')
  local ctype=$(echo "$headers" | grep -i '^content-type:' | sed 's/[Cc]ontent-[Tt]ype: //' | tr -d '\r')
  local powered=$(echo "$headers" | grep -i '^x-powered-by:' | sed 's/[Xx]-[Pp]owered-[Bb]y: //' | tr -d '\r')
  local cf_ray=$(echo "$headers" | grep -i '^cf-ray' | head -1)
  local akamai=$(echo "$headers" | grep -i 'x-akamai' | head -1)
  
  RECON_DATA+="Status: $status\n"
  [ -n "$server" ] && RECON_DATA+="Server: $server\n" && print_info "Server: $server"
  [ -n "$powered" ] && RECON_DATA+="X-Powered-By: $powered\n" && print_info "Powered by: $powered"
  [ -n "$cf_ray" ] && RECON_DATA+="Cloudflare: true\n" && print_warn "Cloudflare detected"
  [ -n "$akamai" ] && RECON_DATA+="Akamai: true\n" && print_warn "Akamai detected"
  
  # 2. Title
  local title=$(get_title "$target")
  [ -n "$title" ] && RECON_DATA+="Page Title: $title\n" && print_info "Title: $title"
  
  # 3. Technologies (basic)
  print_sub "Detecting technologies..."
  local techs=""
  echo "$headers" | grep -qi 'php' && techs+="PHP, " && RECON_DATA+="Tech: PHP\n"
  echo "$headers" | grep -qi 'asp\.net\|x-aspnet' && techs+="ASP.NET, " && RECON_DATA+="Tech: ASP.NET\n"
  echo "$headers" | grep -qi 'nginx' && techs+="Nginx, " && RECON_DATA+="Tech: Nginx\n"
  echo "$headers" | grep -qi 'apache' && techs+="Apache, " && RECON_DATA+="Tech: Apache\n"
  echo "$headers" | grep -qi 'express' && techs+="Express, " && RECON_DATA+="Tech: Express/Node\n"
  echo "$headers" | grep -qi 'django\|python' && techs+="Python/Django, " && RECON_DATA+="Tech: Python/Django\n"
  echo "$headers" | grep -qi 'rails\|ruby' && techs+="Ruby/Rails, " && RECON_DATA+="Tech: Ruby/Rails\n"
  echo "$headers" | grep -qi 'java\|tomcat\|jboss' && techs+="Java, " && RECON_DATA+="Tech: Java\n"
  echo "$headers" | grep -qi 'wordpress' && techs+="WordPress, " && RECON_DATA+="Tech: WordPress\n"
  echo "$headers" | grep -qi 'cloudflare' && techs+="Cloudflare, "
  echo "$headers" | grep -qi 'set-cookie.*session' && RECON_DATA+="Has Session Cookies: true\n"
  
  [ -n "$techs" ] && print_info "Tech: ${techs%, }"
  
  # 4. Check for common paths
  print_sub "Checking common endpoints..."
  local common_paths=("robots.txt" "sitemap.xml" ".git/HEAD" ".env" "admin" "api" "wp-admin" "login" "graphql")
  local found_paths=""
  
  for path in "${common_paths[@]}"; do
    local code=$(http_check "$target/$path" 2>/dev/null)
    if [[ "$code" =~ ^[23] ]]; then
      found_paths+="$path($code), "
      RECON_DATA+="Endpoint Found: /$path (HTTP $code)\n"
      print_find "Found: /$path (HTTP $code)"
    fi
  done
  
  # 5. Page content samples (first 5KB)
  print_sub "Sampling page content..."
  local page_content=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null | head -c 5000)
  
  # Detect forms
  if echo "$page_content" | grep -qi '<form\|<input.*type="\(text\|password\|email\|search\)"\|method="\(get\|post\)"'; then
    RECON_DATA+="Has Forms: true\n"
    print_info "Forms detected on page"
  fi
  
  # Detect login
  if echo "$page_content" | grep -qi 'login\|signin\|password\|type="password"'; then
    RECON_DATA+="Has Login: true\n"
    print_info "Login form detected"
  fi
  
  # Detect search
  if echo "$page_content" | grep -qi 'search\|type="search"\|name="q"\|\bapi\b'; then
    RECON_DATA+="Has Search: true\n"
    print_info "Search functionality detected"
  fi
  
  # Detect file upload
  if echo "$page_content" | grep -qi 'type="file"\|multipart/form-data\|upload'; then
    RECON_DATA+="Has File Upload: true\n"
    print_info "File upload detected"
  fi
  
  # Detect JS frameworks / SPAs
  if echo "$page_content" | grep -qi 'react\|vue\|angular\|next.js\|nuxt'; then
    RECON_DATA+="SPA Framework: true\n"
    print_info "SPA framework detected"
  fi
  
  # Detect API endpoints
  if echo "$page_content" | grep -qi 'api\.\|/v1/\|/v2/\|/api/\|graphql\|rest\|endpoint'; then
    RECON_DATA+="Has API References: true\n"
    print_info "API references found in page"
  fi
  
  # Detect JWT
  if echo "$page_content" | grep -qi 'eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*'; then
    RECON_DATA+="JWT Tokens Found: true\n"
    print_find "JWT tokens detected in page!"
  fi
  
  # Save recon data for the brain
  echo "$RECON_DATA" > "$REPORTS_DIR/.${domain}_recon.txt"
  
  print_ok "Recon complete for $domain"
  return 0
}