#!/bin/bash
# 验证下载区能用（本地 + 公网）。
set -u

BASE=http://127.0.0.1:8080
PUB=https://relay.xxmxxs.top
UA='LanRemote/1.4.0'

echo "===== 1. 本地列出下载文件 ====="
curl -s --max-time 10 "$BASE/v1/downloads" | python3 -m json.tool 2>/dev/null \
    | head -30 || echo "  读不到"

echo
echo "===== 2. 本地下载（只看 HTTP 码和大小）====="
for f in ykxmz-watch-1.5.0.apk ykxmz-server-1.5.0.zip ykxmz-agent-1.5.0.zip; do
    info=$(curl -s --max-time 20 -o /tmp/dl.bin -w '%{http_code} %{size_download} %{content_type}' \
        "$BASE/download/$f" 2>/dev/null)
    printf "  %-32s %s\n" "$f" "$info"
done

echo
echo "===== 3. 公网列出（走隧道）====="
curl -s --max-time 20 -H "User-Agent: $UA" "$PUB/v1/downloads" \
    | head -c 300
echo

echo
echo "===== 4. 公网下载 APK 头几个字节（验证真的能下）====="
code=$(curl -s --max-time 40 -o /tmp/apk_pub.bin -w '%{http_code}' \
    -H "User-Agent: $UA" "$PUB/download/ykxmz-watch-1.5.0.apk" 2>/dev/null)
size=$(stat -c %s /tmp/apk_pub.bin 2>/dev/null || echo 0)
echo "  HTTP $code，下载 $size 字节"
echo -n "  是不是合法 APK（zip 头 PK）: "
head -c 2 /tmp/apk_pub.bin | grep -q 'PK' && echo "是 ✓" || echo "不是 ✗"

echo
echo "===== 5. 安全：目录穿越要被挡住 ====="
for bad in "../relay.py" "..%2Frelay.py" "relay.py" "x.sh"; do
    code=$(curl -s --max-time 10 -o /dev/null -w '%{http_code}' \
        "$BASE/download/$bad" 2>/dev/null)
    printf "  %-20s HTTP %s\n" "$bad" "$code"
done

echo
echo "===== 6. 管理页有没有下载卡片 ====="
KEY=$(cat /root/lanremote-relay/data/admin_key.txt 2>/dev/null)
for needle in 'id=dlPanel' '/v1/downloads' '/download/'; do
    if curl -s --max-time 10 -H "X-Admin: $KEY" "$BASE/" 2>/dev/null \
            | grep -q "$needle"; then
        echo "  ✓ $needle"
    else
        echo "  ✗ $needle"
    fi
done