#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

MODE="${1:-dry}"   # dry | apply
BACKUP_EXT=".bak"

# Perl program: slurp file, normalizza EOL, rimuove ogni <FilesMatch ...>...</FilesMatch>
# che contiene (case-insensitive):
#  - ".(py|exe|php" (o "suspected") e "deny from all"
#  - OR "wp-blog-header.php" e "allow from all"
PERL_PROG='
use strict;
use warnings;
local $/ = undef;
my $s = <>;                # slurp entire file
$s =~ s/\r\n?/\n/g;        # normalize line endings
# remove any FilesMatch block that matches our criteria (case-insensitive, dot matches newline)
$s =~ s{
    <FilesMatch\b[^>]*>     # opening tag
    (.*?)                  # capture inner content (non-greedy)
    </FilesMatch>          # closing tag
}{
    my $inner = $1;
    my $t = lc($inner);
    # criterion 1: short block with .(py|exe|php or suspected) AND deny from all
    if ( $t =~ qr/\.\(py\|exe\|php\|suspected/ && $t =~ /deny\s+from\s+all/ ) {
        ""  # remove block
    }
    # criterion 2: long wordpress list containing wp-blog-header.php AND allow from all
    elsif ( $t =~ /wp-blog-header\.php/ && $t =~ /allow\s+from\s+all/ ) {
        ""  # remove block
    }
    else {
        $&   # keep original block unchanged
    }
}isgex;
# collapse excessive blank lines
$s =~ s/\n{3,}/\n\n/g;
# ensure final newline
$s .= "\n" unless $s =~ /\n\z/;
print $s;
'

# find files
mapfile -d '' FILES < <(find . -type f -name ".htaccess" -print0)

if [ "${#FILES[@]}" -eq 0 ]; then
  echo "Nessun file .htaccess trovato."
  exit 0
fi

echo "Trovati ${#FILES[@]} file .htaccess. Modalità: $MODE"

for f in "${FILES[@]}"; do
  # produce new content in tmp
  tmp="$(mktemp)"
  if ! perl -0777 -e "$PERL_PROG" "$f" > "$tmp"; then
    echo "Errore Perl su: $f" >&2
    rm -f "$tmp"
    continue
  fi

  if cmp -s "$f" "$tmp"; then
    rm -f "$tmp"
    continue
  fi

  if [ "$MODE" = "dry" ]; then
    echo "=== DRY: differenze per $f ==="
    diff -u --label "orig: $f" --label "new: $f.new" "$f" "$tmp" | sed -n '1,200p'
    echo "=== fine diff ==="
    rm -f "$tmp"
  else
    # apply: backup and move
    cp --preserve=mode,timestamps "$f" "$f${BACKUP_EXT}"
    mv "$tmp" "$f"
    echo "Aggiornato: $f (backup: $f${BACKUP_EXT})"
  fi
done

echo "Operazione completata."
exit 0