#!/bin/sh
# Audit: minimal permissions (docs/Минимально_необходимые_полномочия_nginx)
set -eu

REPORT="${REPORT:-/reports/audit.log}"

section() { echo "" >> "$REPORT"; echo "=== $1 ===" >> "$REPORT"; echo "=== $1 ==="; }

: > "$REPORT"
echo "Permissions audit $(date -Iseconds)" >> "$REPORT"

section "Worker user"
nginx -T 2>/dev/null | grep '^user ' >> "$REPORT" || true
ps aux | grep 'nginx:' >> "$REPORT" || true

section "Config permissions"
ls -la /etc/nginx/ >> "$REPORT"
namei -l /etc/nginx/nginx.conf >> "$REPORT" 2>/dev/null || ls -l /etc/nginx/nginx.conf >> "$REPORT"
if su -s /bin/sh nginx -c 'test -w /etc/nginx/nginx.conf' 2>/dev/null; then
  echo "FAIL: nginx can write nginx.conf" >> "$REPORT"
else
  echo "OK: nginx cannot write nginx.conf" >> "$REPORT"
fi

section "Web root permissions"
ls -la /usr/share/nginx/html/public/ >> "$REPORT"
if su -s /bin/sh nginx -c 'test -w /usr/share/nginx/html/public/index.html' 2>/dev/null; then
  echo "FAIL: nginx can write web root" >> "$REPORT"
else
  echo "OK: nginx cannot write web root" >> "$REPORT"
fi

section "TLS certificates and keys"
ls -la /etc/nginx/ssl/ >> "$REPORT"
if su -s /bin/sh nginx -c 'cat /etc/nginx/ssl/server.key' 2>/dev/null; then
  echo "FAIL: nginx can read private key" >> "$REPORT"
else
  echo "OK: nginx cannot read private key" >> "$REPORT"
fi

section "htpasswd"
ls -la /etc/nginx/htpasswd >> "$REPORT" 2>/dev/null || true
if su -s /bin/sh nginx -c 'test -w /etc/nginx/htpasswd' 2>/dev/null; then
  echo "FAIL: nginx can write htpasswd" >> "$REPORT"
else
  echo "OK: nginx cannot write htpasswd" >> "$REPORT"
fi

section "Logs"
ls -la /var/log/nginx/ >> "$REPORT"

section "Temp/cache paths"
ls -la /var/cache/nginx/ >> "$REPORT" 2>/dev/null || echo "cache dir not yet created" >> "$REPORT"
nginx -T 2>/dev/null | grep -E 'client_body_temp_path|proxy_temp_path' >> "$REPORT" || true

echo "Audit permissions complete -> $REPORT"