#!/usr/bin/env bash
# Reproduction script (reference copy). It calls run.py, analyze.py, fixtures.py, launch.py and nonet.sb, which are not in this folder.
# Reproduce the run. Needs: git, uv, brew nuclei 3.11.1 (templates v10.5.1), ZAP 2.17.0 aarch64 app, macOS sandbox-exec.
# Everything scans 127.0.0.1 only, inside nonet.sb (denies all non-loopback network).
set -euo pipefail
HERE="$(cd "$(dirname "$0")" && pwd)"
# 1. fixtures
[ -d /tmp/wsf ] || git clone https://github.com/Excession-Labs/web-security-fixtures /tmp/wsf
git -C /tmp/wsf pull --ff-only
# 2. tools (versions used: nuclei 3.11.1, ZAP 2.17.0)
command -v nuclei >/dev/null || brew install nuclei
nuclei -update-templates || true     # needs network once; the scans below run with no network
ZAP_DIR="${ZAP_DIR:-$HERE/tools}"
if [ ! -d "$ZAP_DIR/ZAP.app" ]; then   # brew cask 'zap' is disabled (Gatekeeper); use the release dmg
  mkdir -p "$ZAP_DIR/zap-dl" && curl -L -o "$ZAP_DIR/zap-dl/ZAP.dmg" https://github.com/zaproxy/zaproxy/releases/download/v2.17.0/ZAP_2.17.0_aarch64.dmg
  hdiutil attach -nobrowse -readonly -mountpoint /tmp/zapmnt "$ZAP_DIR/zap-dl/ZAP.dmg"; cp -R /tmp/zapmnt/ZAP.app "$ZAP_DIR/"; hdiutil detach /tmp/zapmnt
fi
# 3. graphql fixture dependency (isolated venv, uv)
[ -x "$HERE/tools-cache/venv/bin/python" ] || { uv venv --python 3.13 "$HERE/tools-cache/venv"; uv pip install --python "$HERE/tools-cache/venv/bin/python" graphql-core==3.2.14; }
# 4. scans: 27 fixtures; cold = root URL only (vulnerable), seeded = known routes + sample credentials (vulnerable and fixed)
cd "$HERE"
uv run --python 3.13 --no-project python run.py --workers 5
# 5. grade raw output -> results.csv, counts.json
uv run --python 3.13 --no-project python analyze.py