#!/usr/bin/env bash
# ==============================================================================
# OWASP-Compliant Compact SBOM Generator (Ubuntu / Odoo)
# Standaard: CycloneDX 1.4 JSON via Trivy
# ==============================================================================

set -euo pipefail

# 1. Configuratie & Mappenstructuur
OUTPUT_DIR="/var/sbom_scans"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
SCAN_DIR="${OUTPUT_DIR}/${TIMESTAMP}"
mkdir -p "${SCAN_DIR}"

FINAL_SBOM_JSON="${SCAN_DIR}/sbom_cyclonedx.json"
ODOO_CONF="/etc/odoo-server.conf"

echo "[+] OWASP SBOM Generator gestart op $(hostname)..."

# 2. Afhankelijkheden controleren (Trivy + jq)
if ! command -v jq &> /dev/null; then
    apt-get update -qq && apt-get install -y -qq jq
fi

if ! command -v trivy &> /dev/null; then
    echo "[+] Trivy installeren..."
    curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
fi

# 3. Genereer gerichte CycloneDX SBOM
# Volgens OWASP: Alleen relevante runtime packages (Python/Pip + DPKG)
echo "[+] Scannen van Python omgeving, Odoo en OS pakketten..."

trivy fs / \
    --pkg-types os,library \
    --skip-dirs "/proc,/sys,/dev,/run,/tmp,/var/lib/docker,/var/log,/usr/share" \
    --format cyclonedx \
    --output "${FINAL_SBOM_JSON}" \
    --quiet || true

# 4. Resultaat verifiëren en samenvatting tonen
if [ -s "${FINAL_SBOM_JSON}" ]; then
    TOTAL_COMPONENTS=$(jq '.components | length' "${FINAL_SBOM_JSON}" 2>/dev/null || echo "0")
    
    echo "=============================================================================="
    echo " [V] OWASP CycloneDX SBOM Succesvol Gegenereerd!"
    echo " Locatie:    ${FINAL_SBOM_JSON}"
    echo " Componenten: ${TOTAL_COMPONENTS} (Compact & Overzichtelijk)"
    echo "=============================================================================="
    
    # Snel inzicht in de top componenten via CLI zonder de JSON te hoeven openen
    echo ""
    echo "Snel overzicht van de eerste 5 gedetecteerde componenten:"
    jq -r '.components[0:5][] | " - \(.name) (\(.version // "bekende versie")) [\(.type)]"' "${FINAL_SBOM_JSON}" 2>/dev/null || true
    echo ""
else
    echo "[X] Fout: Er is geen inhoud gegenereerd in het SBOM-bestand."
    exit 1
fi