#!/usr/bin/env bash
# check-domains.sh — serial PHP version check against YOUR OWN checker endpoint.
# One domain at a time, with a pause, so a slow site looks slow rather than broken.
#
#   ENDPOINT=https://my-checker.pages.dev ./check-domains.sh domains.txt
#   DELAY=2 ./check-domains.sh domains.txt > results.csv
#
# domains.txt: one host per line (scheme optional). Blank lines ignored.
# Output: CSV on stdout, safe to redirect. "unknown" means "not advertised", not "safe".
set -uo pipefail

ENDPOINT="${ENDPOINT:-http://127.0.0.1:8788}"   # wrangler pages dev default
FILE="${1:-domains.txt}"
DELAY="${DELAY:-1.2}"
OUT="${2:-}"

[ -f "$FILE" ] || { echo "no such file: $FILE" >&2; exit 2; }

emit() { if [ -n "$OUT" ]; then tee -a "$OUT"; else cat; fi; }

echo "domain,verdict,version,evidence" | emit

while IFS= read -r raw; do
  d="$(printf '%s' "$raw" | tr -d '\r' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
  case "$d" in ''|\#*) continue ;; esac

  resp="$(curl -s -m 25 -X POST "$ENDPOINT/api/check" \
            -H 'content-type: application/json' \
            --data "{\"url\":\"$d\"}" 2>/dev/null)"

  line="$(printf '%s' "$resp" | python -c "
import sys, json
try:
    d = json.load(sys.stdin)
except Exception:
    print('$d,error,,\"unreadable response\"'); raise SystemExit
if not d.get('ok'):
    print('%s,error,,\"%s\"' % ('$d', str(d.get('error','')).replace('\"','\''))); raise SystemExit
if d.get('reachable') is False:
    print('%s,unknown,,\"%s\"' % ('$d', str(d.get('reason','no answer')).replace('\"','\''))); raise SystemExit
ev = ' | '.join(d.get('evidence') or []) or d.get('headline','')
print('%s,%s,%s,\"%s\"' % ('$d', d.get('verdict','unknown'), d.get('version') or '', ev.replace('\"','\'')))
" 2>/dev/null)"

  [ -z "${line:-}" ] && line="$d,error,,\"parse failure\""
  printf '%s\n' "$line" | emit
  sleep "$DELAY"
done < "$FILE"

echo "" | emit
echo "# generated $(date -u '+%Y-%m-%dT%H:%M:%SZ') via $ENDPOINT" | emit
echo "# 'unknown' = the server did not advertise a version. Not a pass." | emit