#!/bin/bash
# ═══════════════════════════════════════════════════════════════
# scan.sh — TruffleHog 深度扫描模块
# 对指定 org/user 的所有 repo 做深度 git history 扫描
# ═══════════════════════════════════════════════════════════════
set -euo pipefail

ORG=""
USER=""
TOKEN=""
CONCURRENCY=10
DEEP=false
REPORT_DIR="./results"

CYAN='\033[0;36m'
GREEN='\033[0;32m'
RED='\033[0;31m'
NC='\033[0m'

log_info()  { echo -e "${CYAN}[*]${NC} $1"; }
log_found() { echo -e "${GREEN}[+]${NC} $1"; }
log_err()   { echo -e "${RED}[-]${NC} $1"; }

while [[ $# -gt 0 ]]; do
    case "$1" in
        --org)         ORG="$2"; shift 2 ;;
        --user)        USER="$2"; shift 2 ;;
        --token)       TOKEN="$2"; shift 2 ;;
        --concurrency) CONCURRENCY="$2"; shift 2 ;;
        --deep)        DEEP="$2"; shift 2 ;;
        --report)      REPORT_DIR="$2"; shift 2 ;;
        *)             shift ;;
    esac
done

mkdir -p "$REPORT_DIR"

# ── 检查 trufflehog ───────────────────────────────────────
if ! command -v trufflehog &>/dev/null; then
    log_info "trufflehog 未安装，正在安装..."
    curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/install.sh | sh -s -- -b /usr/local/bin
fi

# ── 扫描 ──────────────────────────────────────────────────
TH_FLAGS=(
    --json
    --results="${REPORT_DIR}/trufflehog_results.json"
    --concurrency="$CONCURRENCY"
)

# 只输出验证通过的 key
TH_FLAGS+=(--only-verified)

if [[ -n "$ORG" ]]; then
    log_info "深度扫描 org: $ORG"
    trufflehog github --org="$ORG" --token="$TOKEN" "${TH_FLAGS[@]}"

elif [[ -n "$USER" ]]; then
    log_info "深度扫描 user: $USER"
    trufflehog github --user-targets="$USER" --token="$TOKEN" "${TH_FLAGS[@]}"

else
    log_err "需要指定 --org 或 --user"
    exit 1
fi

# ── 提取结果 ──────────────────────────────────────────────
RESULTS_FILE="${REPORT_DIR}/trufflehog_results.json"
if [[ -f "$RESULTS_FILE" ]]; then
    count=$(jq -s 'length' "$RESULTS_FILE" 2>/dev/null || echo 0)
    log_found "发现 $count 个 verified secret"

    # 按 provider 分类输出
    jq -r '.[] | "\(.DetectorName)|\(.Raw)|\(.SourceMetadata.Data.github.repository)|\(.DetectorName)"' \
        "$RESULTS_FILE" 2>/dev/null > "${REPORT_DIR}/trufflehog_keys.txt" || true

    log_info "结果保存至: ${REPORT_DIR}/trufflehog_keys.txt"
else
    log_err "无结果文件"
fi