#!/usr/bin/env bash

# --- Temporary jq setup ---
JQ_BIN="./jq-temp"

download_jq() {
  unameOut="$(uname -s)"
  case "${unameOut}" in
      Linux*)     os=linux;;
      Darwin*)    os=mac;;
      CYGWIN*|MINGW*|MSYS*) os=win;;
      *)          os="unknown"
  esac

  arch="$(uname -m)"
  case "${arch}" in
      x86_64) arch="64";;
      aarch64) arch="arm64";;
      *) arch="64";;
  esac

  echo "Downloading jq for $os-$arch..."

  if [ "$os" = "linux" ]; then
    curl -L -o "$JQ_BIN" "https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux${arch}"
  elif [ "$os" = "mac" ]; then
    curl -L -o "$JQ_BIN" "https://github.com/stedolan/jq/releases/download/jq-1.6/jq-osx-amd64"
  elif [ "$os" = "win" ]; then
    curl -L -o "$JQ_BIN.exe" "https://github.com/stedolan/jq/releases/download/jq-1.6/jq-win64.exe"
    JQ_BIN="$JQ_BIN.exe"
  else
    echo "Unsupported OS: $os"
    exit 1
  fi

  chmod +x "$JQ_BIN"
}

cleanup_jq() {
  rm -f "$JQ_BIN"
}

# --- Ensure jq available ---
download_jq

# --- Vulnerable ranges ---
VULN_REACT_RANGES=(
  "<=19.0.0"
  "<=19.1.0"
  "<=19.1.1"
  "<=19.2.0"
)

VULN_NEXT_RANGES=(
  "<=15.0.4"
  "<=15.1.8"
  "<=15.2.5"
  "<=15.3.5"
  "<=15.4.7"
  "<=15.5.6"
  "<=16.0.6"
)

VULN_NEXT_CANARY=">=14.3.0-canary.77"

affected=false
declare -A matches

# --- Scan all package.json files ---
while read -r file; do
  for dep in $("$JQ_BIN" -r '.dependencies // {} | keys[]' "$file"; "$JQ_BIN" -r '.devDependencies // {} | keys[]' "$file"); do
    version=$("$JQ_BIN" -r ".dependencies[\"$dep\"] // .devDependencies[\"$dep\"]" "$file")
    installed_version=$(npm list "$dep" --depth=0 --json | "$JQ_BIN" -r ".dependencies[\"$dep\"].version")

    if [[ $dep =~ ^react-server-dom- ]]; then
      for range in "${VULN_REACT_RANGES[@]}"; do
        if npx semver -r "$range" "$installed_version"; then
          affected=true
          matches["$dep - version in package.json - $version installed version $installed_version in $file"]=1
        fi
      done
    fi

    if [[ $dep == "next" ]]; then
      for range in "${VULN_NEXT_RANGES[@]}"; do
        if npx semver -r "$range" "$installed_version"; then
          affected=true
          matches["$dep - version in package.json - $version installed version $installed_version in $file"]=1
        fi
      done

      if npx semver -r "$VULN_NEXT_CANARY" "$installed_version"; then
        affected=true
        matches["$dep - version in package.json - $version installed version $installed_version in $file"]=1
      fi
    fi
  done
done < <(find . -name "package.json")

# --- Final output ---
if [ "$affected" = true ]; then
  echo "This project is affected by CVE-2025-55182"
  echo "Vulnerable packages found:"
  for m in "${!matches[@]}"; do
    echo "  - $m"
  done
  exit 1
else
  echo "This project is not affected by CVE-2025-55182"
  exit 0
fi

# --- Cleanup ---
cleanup_jq