#!/bin/bash

echo "🔒 Starting Security Audit Check..."
echo "------------------------------------"

echo "🔍 [1] Checking Risky Open Ports..."
OPEN_PORTS=$(netstat -tuln | awk '{print $4}' | grep -E ':(22|3306|21)$')
if [ -z "$OPEN_PORTS" ]; then
    echo "✅ PASS: No unauthorized risky ports are open."
else
    echo "❌ WARNING: The following risky ports are exposed:"
    echo "$OPEN_PORTS"
fi
echo "------------------------------------"

echo "🌐 [2] Checking SSL Certificate Expiry for mithal.space..."
DOMAIN="mithal.space"
EXPIRY_DATE=$(echo | openssl s_client -servername $DOMAIN -connect $DOMAIN:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | cut -d= -f2)
if [ -n "$EXPIRY_DATE" ]; then
    EXPIRY_SEC=$(date -d "$EXPIRY_DATE" +%s)
    NOW_SEC=$(date +%s)
    DAYS_LEFT=$(( ($EXPIRY_SEC - $NOW_SEC) / 86400 ))
    if [ $DAYS_LEFT -gt 30 ]; then
        echo "✅ PASS: SSL certificate is valid. Expires in $DAYS_LEFT days."
    else
        echo "⚠️ WARNING: SSL certificate expires soon (in $DAYS_LEFT days)!"
    fi
else
    echo "❌ ERROR: Could not retrieve SSL certificate."
fi
echo "------------------------------------"

echo "📁 [3] Checking Sensitive File Permissions..."
SENSITIVE_FILE=".env" 
if [ -f "$SENSITIVE_FILE" ]; then
    PERMISSIONS=$(stat -c "%a" "$SENSITIVE_FILE")
    if [ "$PERMISSIONS" -le 600 ]; then
        echo "✅ PASS: Permissions for $SENSITIVE_FILE are secure ($PERMISSIONS)."
    else
        echo "❌ WARNING: Permissions for $SENSITIVE_FILE are too open ($PERMISSIONS)!"
    fi
else
    echo "ℹ️ INFO: No $SENSITIVE_FILE found."
fi
echo "------------------------------------"
echo "🏁 Security Audit Check Completed."