#!/bin/bash
# Build summary markdown from report logs.
set -euo pipefail

TS="${1:-unknown}"
REPORTS="${REPORTS_DIR:-/reports}"
OUT="$REPORTS/${TS}_summary.md"

pmi="$REPORTS/${TS}_pmi.log"
audit="$REPORTS/${TS}_audit.log"
fim="$REPORTS/${TS}_fim.log"

count_status() {
  local file="$1" status="$2"
  local n=0
  if [ -f "$file" ]; then
    n=$(grep -c "^${status}  " "$file" 2>/dev/null) || n=0
  fi
  echo "$n"
}

pass_pmi=$(count_status "$pmi" PASS)
fail_pmi=$(count_status "$pmi" FAIL)
pass_fim=$(count_status "$fim" PASS)
fail_fim=$(count_status "$fim" FAIL)

{
  echo "# Сводный отчёт nginx PMI stand"
  echo ""
  echo "**Дата прогона:** $TS"
  echo "**Стенд:** Docker Compose (\`results/docker-compose.yml\`)"
  echo ""
  echo "## Результаты ПМИ"
  echo ""
  echo "| Метрика | Значение |"
  echo "|---------|----------|"
  echo "| PASS | $pass_pmi |"
  echo "| FAIL | $fail_pmi |"
  echo ""
  echo "## Целостность (FIM stand-in)"
  echo ""
  echo "| Метрика | Значение |"
  echo "|---------|----------|"
  echo "| PASS | $pass_fim |"
  echo "| FAIL | $fail_fim |"
  echo ""
  echo "> FIM выполнен через SHA256 baseline (\`run-fim-checksum.sh\`), не afick."
  echo "> Syslog проверялся локальным syslog-ng, не корпоративным SIEM."
  echo ""
  echo "## Файлы отчётов"
  echo ""
  echo "- [\`${TS}_pmi.log\`](${TS}_pmi.log)"
  echo "- [\`${TS}_audit.log\`](${TS}_audit.log)"
  echo "- [\`${TS}_fim.log\`](${TS}_fim.log)"
  echo ""
  echo "## PMI log excerpt"
  echo ""
  echo '```'
  [ -f "$pmi" ] && grep -E '^(PASS|FAIL|SKIP|===)' "$pmi" || echo "(no pmi log)"
  echo '```'
  echo ""
  echo "## FIM log excerpt"
  echo ""
  echo '```'
  [ -f "$fim" ] && cat "$fim" || echo "(no fim log)"
  echo '```'
} > "$OUT"

echo "Summary written: $OUT"