#!/bin/bash
# Fase 3: manifiestos sha256 + escaneo de seguridad del propio mirror (§4.3 del plan)
set -uo pipefail
BASE=/home/rafa/joomla-migration/mirror-antiguo
RUN=$(cat "$BASE/CURRENT_RUN")
DIR=$BASE/runs/$RUN
cd "$DIR"

echo "=== manifiesto raw ==="
( cd raw && find . -type f -print0 | sort -z | xargs -0 sha256sum ) > MANIFEST-raw.sha256
wc -l < MANIFEST-raw.sha256
du -sh raw

echo
echo "=== 1. ficheros con PHP ejecutable ==="
grep -rl '<?php' raw > scan-php.txt 2>/dev/null
wc -l < scan-php.txt

echo "=== 2. patrones tipicos de inyeccion ==="
grep -rlE 'eval\(|atob\(|document\.write\(unescape|fromCharCode' raw > scan-suspicious.txt 2>/dev/null
wc -l < scan-suspicious.txt

echo "=== 3. paginas de challenge/error congeladas ==="
grep -rli 'Attention Required\|Just a moment\|Not Acceptable\|mod_security\|Internal Server Error' raw > scan-garbage.txt 2>/dev/null
wc -l < scan-garbage.txt

echo "=== 4. hosts externos en script/iframe ==="
grep -rhoE '<(script|iframe)[^>]+src="https?://[^"/]+' raw \
  | grep -oE 'https?://[^"/]+' | sort | uniq -c | sort -rn > scan-external-script-hosts.txt
head -25 scan-external-script-hosts.txt

echo
echo "=== 5. cobertura frente al inventario ==="
find raw/antiguo.feadulta.com -type f -name '*.html' \
  | sed 's#^raw/antiguo.feadulta.com#http://antiguo.feadulta.com#' | sort -u > captured-pages.txt
comm -23 <(sort -u "$BASE/inventory/urls-input.txt" | sed 's#/es/$#/es/index.html#') captured-pages.txt > coverage-missing.txt
echo "inventario:  $(wc -l < "$BASE/inventory/urls-input.txt")"
echo "capturadas:  $(wc -l < captured-pages.txt)"
echo "sin capturar (aprox): $(wc -l < coverage-missing.txt)"
head -20 coverage-missing.txt