#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

MODE="${1:-dry}"   # dry | apply
BACKUP_EXT=".bak"
TMPDIR="$(mktemp -d)"

echo "Mode: $MODE"
echo "Temp dir: $TMPDIR"

awk_program=$(cat <<'AWK'
BEGIN {
  IGNORECASE = 1;
  inblock = 0;
  block = "";
  openline = "";
}
{
  line = $0;
  if (inblock == 0) {
    if (match(line, /^[[:space:]]*<FilesMatch\b/)) {
      inblock = 1;
      block = line "\n";
      openline = line;
    } else {
      print line;
    }
  } else {
    block = block line "\n";
    if (match(line, /<\/FilesMatch>/)) {
      attrs = openline;
      low = tolower(block);
      low_attrs = tolower(attrs);
      remove = 0;
      # criterio 1: controllo semplificato per la presenza delle sottostringhe senza usare grouping
      if ( index(low_attrs, ".(py") || index(low_attrs, ".(exe") || index(low_attrs, ".(php") || index(low_attrs, ".(suspected") ||
           index(low, ".(py") || index(low, ".(exe") || index(low, ".(php") || index(low, ".(suspected") ) {
        if ( low ~ /deny[[:space:]]+from[[:space:]]+all/ ) { remove = 1; }
      }
      # criterio 2: check per wp-blog-header.php e allow from all
      if ( index(low, "wp-blog-header.php") && low ~ /allow[[:space:]]+from[[:space:]]+all/ ) { remove = 1; }
      if (remove == 1) {
        # skip printing -> rimuovi il blocco
      } else {
        printf "%s", block;
      }
      inblock = 0;
      block = "";
      openline = "";
    }
  }
}
END {
  if (inblock == 1) {
    printf "%s", block;
  }
}
AWK
)

# trova file .htaccess
mapfile -d '' FILES < <(find . -type f -name ".htaccess" -print0)

if [ "${#FILES[@]}" -eq 0 ]; then
  echo "Nessun file .htaccess trovato."
  rm -rf "$TMPDIR"
  exit 0
fi

echo "Trovati ${#FILES[@]} file .htaccess"

for f in "${FILES[@]}"; do
  out="$TMPDIR/$(basename "$f").out"
  awk "$awk_program" "$f" > "$out" || { echo "Errore AWK su $f"; rm -f "$out"; continue; }

  if cmp -s "$f" "$out"; then
    rm -f "$out"
    continue
  fi

  if [ "$MODE" = "dry" ]; then
    echo "=== DRY diff per $f ==="
    diff -u --label "orig: $f" --label "new: $f.new" "$f" "$out" | sed -n '1,200p' || true
    echo "=== fine diff ==="
    rm -f "$out"
  else
    cp --preserve=mode,timestamps "$f" "$f${BACKUP_EXT}"
    mv "$out" "$f"
    echo "Aggiornato: $f (backup: $f${BACKUP_EXT})"
  fi
done

rm -rf "$TMPDIR"
echo "Completato."
exit 0