#!/usr/bin/env python3
"""Use current approved values only in memory; never emit or persist secrets."""
import base64
import html
import json
import shlex
import subprocess
from pathlib import Path
from urllib.parse import quote,quote_plus
root=Path(__file__).parent
reports={}
for lane,pid in [('B',10001),('C',112175)]:
    runtime='/tmp/cdx-gift-date-'+lane+'-20261011';php='/usr/local/php7.3/bin/php'if lane=='B'else'/www/server/php/73/bin/php'
    parent='/tmp/zhct-http-store-mysql.dQTTBP'if lane=='B'else'/tmp/zhct-dm-poc-20260928.fcpiiN/store'
    code='$env=[];foreach(explode(chr(0),file_get_contents("/proc/'+str(pid)+'/environ"))as $s){$v=explode("=",$s,2);if(count($v)===2){$env[$v[0]]=$v[1];putenv($v[0]."=".$v[1]);}}$cfg=(static function($p){return require $p;})('+repr(parent+'/application/database.php')+');$request=json_decode(file_get_contents('+repr(runtime+'/private-request.json')+'),true);$out=[$request["token"]];$walk=null;$walk=function($v,$k="")use(&$walk,&$out){if(is_array($v))foreach($v as $key=>$value)$walk($value,(string)$key);elseif(is_scalar($v)&&preg_match("/password|pwd|token|secret|key|credential/i",$k)&&strlen((string)$v)>=4)$out[]=(string)$v;};$walk($cfg);foreach($env as $key=>$value)if(preg_match("/password|pwd|token|secret|key|credential/i",$key)&&strlen($value)>=4)$out[]=$value;echo json_encode(array_values(array_unique($out)));'
    args=['docker','exec','zhctapp_v2_0',php,'-r',code]if lane=='B'else['ssh','-S','/private/tmp/cdx-train-root-20261010.sock','-o','BatchMode=yes','root@121.43.241.161',php+' -r '+shlex.quote(code)]
    values=json.loads(subprocess.check_output(args))
    files=[file for file in(root/'private-evidence').rglob('*')if file.is_file()]
    variants=set()
    for value in values:
        for variant in [value,html.escape(value,quote=True),quote(value,safe=''),quote_plus(value),base64.b64encode(value.encode()).decode(),json.dumps(value,ensure_ascii=False)[1:-1]]:
            if len(value)<8:
                variants.add(('"'+variant+'"').encode());variants.add(("'"+variant+"'").encode())
            else:variants.add(variant.encode())
    matches=[]
    for file in files:
        data=file.read_bytes()
        if any(variant in data for variant in variants):matches.append(file.relative_to(root).as_posix())
    assert matches==[], 'Actual secret found in controlled artifact: '+repr(matches)
    reports[lane]={'files_scanned':len(files),'actual_values_checked':len(values),'encoded_variants_checked':len(variants),'matches':0,'secrets_persisted':False}
output=root/'secret-scan-summary.json';output.write_text(json.dumps({'passed':True,'lanes':reports},indent=2)+'\n')
print(json.dumps({'passed':True,'lanes':reports}))