#!/usr/bin/env python3
"""Extract real secrets from git history across all repos."""
import subprocess, re, os

BITBUCKET = "/root/ir-assessment/redteam/yajny/L3/bitbucket_full"
SSH_KEY = "/root/ir-assessment/redteam/yajny/L3/ssh_keys/BitbucketSSH.pem"
os.environ["GIT_SSH_COMMAND"] = f"ssh -i {SSH_KEY} -o StrictHostKeyChecking=no -o IdentitiesOnly=yes"

SECRET_PATTERNS = [
    (r'(DB_PASSWORD|DB_PASS)\s*[=:]\s*[\'"]([^\'"]{4,})[\'"]', "DB_PASSWORD"),
    (r'(API_KEY|apikey|api-key)\s*[=:]\s*[\'"]([A-Za-z0-9_\-]{16,})[\'"]', "API_KEY"),
    (r'(SECRET|secret_key|APP_KEY)\s*[=:]\s*[\'"]([A-Za-z0-9+/=]{16,})[\'"]', "SECRET"),
    (r'(CLIENT_SECRET|client_secret)\s*[=:]\s*[\'"]([^\'"]{8,})[\'"]', "CLIENT_SECRET"),
    (r'(ACCESS_TOKEN|access_token)\s*[=:]\s*[\'"]([A-Za-z0-9_\-]{20,})[\'"]', "ACCESS_TOKEN"),
    (r'(TOKEN|token)\s*[=:]\s*[\'"]([A-Za-z0-9_\-\.]{20,})[\'"]', "TOKEN"),
    (r'(PASSWORD|password)\s*[=:]\s*[\'"]([^\'"\s]{4,})[\'"]', "PASSWORD"),
    (r'identity_token.*?[\'"]([A-Za-z0-9_\-\.]{50,})[\'"]', "JWT_TOKEN"),
    (r'(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)\s*[=:]\s*[\'"]([A-Za-z0-9/+=]{16,})[\'"]', "AWS"),
    (r'(STRIPE|PAYPAL|SQUARE)\s*[=:]\s*[\'"]([A-Za-z0-9_\-]{16,})[\'"]', "PAYMENT"),
]

results = []

for repo_file in sorted(os.listdir(BITBUCKET)):
    if not repo_file.endswith(".git"):
        continue
    repo_name = repo_file.replace(".git", "")
    repo_path = f"{BITBUCKET}/{repo_file}"
    
    # Get all commits
    log = subprocess.run(
        ["git", "--git-dir", repo_path, "log", "--all", "--format=%H %s"],
        capture_output=True, text=True, timeout=60
    )
    commits = log.stdout.strip().split("\n") if log.stdout.strip() else []
    print(f"{repo_name}: {len(commits)} commits")
    
    # Search in all diffs
    diff = subprocess.run(
        ["git", "--git-dir", repo_path, "log", "--all", "-p", "--diff-filter=AM"],
        capture_output=True, timeout=120
    )
    diff_stdout = diff.stdout.decode("utf-8", errors="replace")
    
    for pattern, ptype in SECRET_PATTERNS:
        matches = re.findall(pattern, diff_stdout, re.IGNORECASE)
        for match in matches:
            if isinstance(match, tuple):
                val = match[-1] if len(match) > 1 else match[0]
            else:
                val = match
            # Filter false positives
            if val in ("null", "true", "false", "example", "your_key", "test", "password"):
                continue
            if len(val) < 8:
                continue
            entry = f"{repo_name} | {ptype} | {val}"
            if entry not in results:
                results.append(entry)

# Save
with open("/root/ir-assessment/redteam/yajny/L3/git_history_secrets.txt", "w") as f:
    f.write(f"=== GIT HISTORY SECRETS — {len(results)} found ===\n\n")
    for r in sorted(results):
        f.write(r + "\n")

print(f"\nTotal secrets found: {len(results)}")
print("Saved to L3/git_history_secrets.txt")