#!/usr/bin/env python3
"""Extract LoggingFilter + auth/user/payment patterns from Loki via Grafana proxy."""
import json, subprocess, sys, re

BASE = "https://grafana.adgentic.tv"
COOKIE = ".session_cookies"

def loki_query(expr, hours=24, max_lines=500):
    payload = json.dumps({
        'queries': [{'refId':'A','datasource':{'uid':'loki','type':'loki'},
                     'expr': expr, 'queryType':'range', 'maxLines': max_lines}],
        'from': f'now-{hours}h', 'to': 'now'
    })
    with open('/tmp/loki_q.json','w') as f:
        f.write(payload)
    r = subprocess.run(
        ['curl','-sk','-b',COOKIE,'-X','POST',
         f'{BASE}/api/ds/query','-H','Content-Type: application/json',
         '-d','@/tmp/loki_q.json'],
        capture_output=True, text=True
    )
    try:
        d = json.loads(r.stdout)
        frames = d.get('results',{}).get('A',{}).get('frames',[])
        lines = []
        for f in frames:
            vals = f.get('data',{}).get('values',[])
            if len(vals) > 2:
                lines.extend(vals[2])
        return lines
    except Exception as e:
        print(f"PARSE ERROR: {e}", file=sys.stderr)
        return []

# Patterns to hunt for
QUERIES = [
    ("LOGGING_FILTER all (48h, 500 lines)",
     '{namespace="prod",app="prod-backend"} |~ "LoggingFilter"',
     48, 500),
    ("AUTH/LOGIN/REGISTER flows (7d)",
     '{namespace="prod",app="prod-backend"} |~ "(?i)(login|register|signin|signup|auth/token|/api/v1/auth|/api/v1/users|password|reset)"',
     168, 100),
    ("PAYMENT/INVOICE/BILLING (7d)",
     '{namespace="prod",app="prod-backend"} |~ "(?i)(payment|invoice|billing|charge|stripe|paypal|razorpay|card|subscription|plan)"',
     168, 100),
    ("API KEYS / TOKENS in logs (7d)",
     '{namespace="prod",app="prod-backend"} |~ "(?i)(api[_-]?key|bearer|authorization|x-api-key|x-auth-token|jwt|access[_-]?token|refresh[_-]?token)"',
     168, 100),
    ("CUSTOMER USER emails (7d, extract unique)",
     '{namespace="prod",app="prod-backend"} |~ "USER=[^;]+"',
     168, 500),
    ("DATABASE/SQL queries (24h)",
     '{namespace="prod",app="prod-backend"} |~ "(?i)(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|jdbc:|mysql:|SQL)"',
     24, 50),
    ("SEEDANCE/VIDEO GEN/AI provider (7d)",
     '{namespace="prod",app="prod-backend"} |~ "(?i)(seedance|openai|anthropic|replicate|huggingface|model|llm|gpt|claude|gemini)"',
     168, 50),
    ("Pubmatic/Activate credentials (7d)",
     '{namespace="prod",app="prod-backend"} |~ "(?i)(pubmatic|activate|token|credential|member_id|publisher_id|site_id|tag_id)"',
     168, 100),
]

def main():
    emails = set()
    api_endpoints = set()
    auth_patterns = []

    for label, expr, hours, limit in QUERIES:
        print(f"\n{'='*70}")
        print(f"QUERY: {label}")
        print(f"{'='*70}")
        lines = loki_query(expr, hours=hours, max_lines=limit)
        print(f"lines returned: {len(lines)}")
        for i, l in enumerate(lines[:limit]):
            s = str(l)
            for m in re.finditer(r'USER=([^;]+)', s):
                emails.add(m.group(1))
            for m in re.finditer(r'URI=([^;]+)', s):
                api_endpoints.add(m.group(1))
            for pat in ['Bearer', 'authorization', 'api_key', 'apikey', 'token=', 'jwt']:
                if pat.lower() in s.lower():
                    auth_patterns.append(s[:800])
            print(f"[{i+1}] {s[:800]}")

    print(f"\n{'='*70}")
    print(f"AGGREGATED FINDINGS")
    print(f"{'='*70}")
    print(f"\nUnique customer USER emails found ({len(emails)}):")
    for e in sorted(emails):
        print(f"  {e}")
    print(f"\nUnique API endpoints found ({len(api_endpoints)}):")
    for e in sorted(api_endpoints):
        print(f"  {e}")
    print(f"\nAuth-related log lines ({len(auth_patterns)}):")
    for p in auth_patterns[:20]:
        print(f"  {p[:500]}")

if __name__ == "__main__":
    main()