#!/bin/bash
set -e

export $(grep -v '^#' /etc/keypme-qa-monitoring | xargs -d '\n')

# Ensure there is no vulnerabilities and SBOM from other run
rm -f /tmp/*-vulnerabilities.json /tmp/*-sbom.spdx.json

#
# Function to download the latest SBOM
#
download_latest_sbom() {
  local project="$1"        # e.g. "labapart/authapart-server"
  local package_name="$2"   # e.g. "keypme-server"

  local project_encoded="${project//\//%2F}"

  # Retrieve the latest version
  local latest_version
  latest_version=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
    "https://gitlab.com/api/v4/projects/${project_encoded}/packages?package_name=${package_name}-sbom&order_by=created_at&sort=desc&per_page=1" \
    | jq -r '.[0].version')

  if [[ -z "$latest_version" || "$latest_version" == "null" ]]; then
    echo "ERROR: could not determine latest version for package '${package_name}' in project '${project}'" >&2
    return 1
  fi

  # Download the latest version
  curl --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
    -o "/tmp/${package_name}-sbom.spdx.json" \
    "https://gitlab.com/api/v4/projects/${project_encoded}/packages/generic/${package_name}-sbom/${latest_version}/${package_name}-sbom-${latest_version}.spdx.json"
}

download_and_analyse_latest_sbom() {
  local project="$1"        # e.g. "labapart/authapart-server"
  local package_name="$2"   # e.g. "keypme-server"

  download_latest_sbom "$project" "$package_name"
  grype sbom:/tmp/${package_name}-sbom.spdx.json -o json > /tmp/${package_name}-vulnerabilities.json
}

# KeypMe Server SBOM
download_and_analyse_latest_sbom "labapart/authapart-server" "keypme-server"
# KeypMe Card Management Java client SBOM
download_and_analyse_latest_sbom "labapart/authapart-server" "keypme-card-management-java-client"
# KeypMe Network Bridge server SBOM
download_and_analyse_latest_sbom "labapart/keypme_network_bridge" "keypme-network-bridge-server"
# KeypMe Network Bridge Java client SBOM
download_and_analyse_latest_sbom "labapart/keypme_network_bridge" "keypme-network-bridge-java-client"
# KeypMe PKCS#11 Bridge Java client SBOM
download_and_analyse_latest_sbom "labapart/keypme_pkcs11_bridge" "keypme-pkcs11-bridge-java-client"
# KeypMe PKCS#11 Bridge Python client SBOM
download_and_analyse_latest_sbom "labapart/keypme_pkcs11_bridge" "keypme-pkcs11-bridge-python-client"

cd /opt/keypme-qa-monitoring
/opt/keypme-qa-monitoring/venv/bin/python3 vulnerability-monitoring/grype_report.py \
  --json keypme_server=/tmp/keypme-server-vulnerabilities.json \
  --json keypme-card-management-java-client=/tmp/keypme-card-management-java-client-vulnerabilities.json \
  --json keypme-network-bridge-server=/tmp/keypme-network-bridge-server-vulnerabilities.json \
  --json keypme-network-bridge-java-client=/tmp/keypme-network-bridge-java-client-vulnerabilities.json \
  --json keypme-pkcs11-bridge-java-client=/tmp/keypme-pkcs11-bridge-java-client-vulnerabilities.json \
  --json keypme-pkcs11-bridge-python-client=/tmp/keypme-pkcs11-bridge-python-client-vulnerabilities.json
