#!/usr/bin/env bash
# verify_coolcoth_deploy.sh
# 部署到 coolcoth.com 后自动复核安全响应头是否生效。
# 用法： bash verify_coolcoth_deploy.sh
set -u
HOST="coolcoth.com"
pass=0; fail=0
check(){ # $1=名称 $2=是否通过(1/0) $3=实际值
  if [ "$2" = "1" ]; then echo "[PASS] $1"; pass=$((pass+1));
  else echo "[FAIL] $1  -> 实际: $3"; fail=$((fail+1)); fi
}

hdr=$(curl -s -D - -o /dev/null -m 15 "https://$HOST/")
hsts=$(printf '%s' "$hdr" | tr -d '\r' | awk -F': ' 'tolower($1)=="strict-transport-security"{print $2}')
ref=$(printf '%s' "$hdr"  | tr -d '\r' | awk -F': ' 'tolower($1)=="referrer-policy"{print $2}')
perm=$(printf '%s' "$hdr" | tr -d '\r' | awk -F': ' 'tolower($1)=="permissions-policy"{print $2}')
xct=$(printf '%s' "$hdr"  | tr -d '\r' | awk -F': ' 'tolower($1)=="x-content-type-options"{print $2}')

echo "=== coolcoth.com 部署复核 @ $(date '+%F %T') ==="
echo "$hsts" | grep -q "max-age=63072000"        && check "HSTS max-age=63072000" 1 || check "HSTS max-age" 0 "$hsts"
echo "$hsts" | grep -q "includeSubDomains"       && check "HSTS includeSubDomains" 1 || check "HSTS includeSubDomains" 0 "$hsts"
echo "$hsts" | grep -q "preload"                 && check "HSTS preload" 1 || check "HSTS preload" 0 "$hsts"
echo "$ref"  | grep -qi "strict-origin-when-cross-origin" && check "Referrer-Policy=strict-origin-when-cross-origin" 1 || check "Referrer-Policy" 0 "$ref"
echo "$perm" | grep -q "payment=()"              && check "Permissions-Policy 含 payment=()" 1 || check "Permissions-Policy payment" 0 "$perm"
echo "$xct"  | grep -qi "nosniff"                && check "X-Content-Type-Options=nosniff" 1 || check "X-Content-Type-Options" 0 "$xct"

echo "----"
echo "PASS=$pass  FAIL=$fail"
[ "$fail" = "0" ] && echo ">> 部署成功 ✅（所有安全头已生效）" || echo ">> 仍有未生效项 ❌（部署/清OPcache未完成）"

echo
echo "【登录 429 限流需人工确认】验证码为算术图，外部自动化无法解；请按手册第5步用有效 csrf+captcha 压测 5~6 次错密，确认返回 429。"