#!/usr/bin/env bash
# Live CSRF matrix over EVERY unsafe route of a running tmplatformd (dev-login profile).
# Usage: csrf-matrix.sh [base-url] [cookie-name]
set -u
B=${1:-http://127.0.0.1:8102}
N=${2:-__Host-tm_session}
TOK=$(curl -s --noproxy '*' -i -X POST "$B/auth/dev-login" | sed -n "s/^Set-Cookie: ${N}=\([^;]*\).*/\1/p")
[ -z "$TOK" ] && { echo "no session issued"; exit 1; }
code() { curl -s --noproxy '*' -o /dev/null -w '%{http_code}' "$@"; }
routes=(
  "POST $B/v0/books/bk1/runs"
  "POST $B/v0/runs/r1/stop"
  "POST $B/v0/runs/r1/resume"
  "POST $B/v0/books"
  "POST $B/auth/logout"
  "POST $B/auth/logout-all"
  "POST $B/auth/dev-login"
  "PUT  $B/v0/books/bk1"
  "DELETE $B/v0/books/bk1"
)
printf '%-34s %-9s %-9s %-9s %-9s %-9s\n' ROUTE bare +hdr xsite+h origin+h nocookie
for r in "${routes[@]}"; do
  m=${r%% *}; u=${r##* }
  bare=$(code -X "$m" -H "Cookie: ${N}=${TOK}" "$u")
  hdr=$(code -X "$m" -H "Cookie: ${N}=${TOK}" -H 'X-TM-Client: probe' "$u")
  xs=$(code -X "$m" -H "Cookie: ${N}=${TOK}" -H 'X-TM-Client: probe' -H 'Sec-Fetch-Site: cross-site' "$u")
  org=$(code -X "$m" -H "Cookie: ${N}=${TOK}" -H 'X-TM-Client: probe' -H 'Origin: https://evil.example' "$u")
  noc=$(code -X "$m" "$u")
  printf '%-34s %-9s %-9s %-9s %-9s %-9s\n' "$m ${u#$B}" "$bare" "$hdr" "$xs" "$org" "$noc"
done