use reqwest::blocking::Client;
use serde_json::Value;
use std::error::Error;

#[derive(Debug)]
struct ValidationResult {
    endpoint: String,
    vuln_type: &'static str,
    status: Status,
    evidence: Option<String>,
}

#[derive(Debug, PartialEq)]
enum Status {
    Fixed,
    StillVulnerable,
    Unreachable,
}

fn main() -> Result<(), Box<dyn Error>> {
    let client = Client::builder()
        .timeout(std::time::Duration::from_secs(10))
        .build()?;

    let mut results = Vec::new();

    // ━━━ Test 1: SSRF via URL parameter (previously exploitable)
    println!("[*] Validating SSRF fix on /api/fetch...");
    let ssrf_result = test_ssrf_fixed(
        &client,
        "https://api.target.client/api/fetch?url=http://169.254.169.254/latest/meta-data/",
    );
    results.push(ssrf_result);

    // ━━━ Test 2: IDOR on account retrieval endpoint
    println!("[*] Validating IDOR fix on /api/accounts/:id...");
    let idor_result = test_idor_fixed(
        &client,
        "https://api.target.client/api/accounts/99999", // unauthorized acct
        "Bearer eyJ0eXAiOiJKV1QiLCJhbGc...",            // user token
    );
    results.push(idor_result);

    // ━━━ Test 3: Blind SSRF via Referer header injection
    println!("[*] Validating header-based SSRF...");
    let blind_ssrf = test_blind_ssrf(
        &client,
        "https://api.target.client/api/webhook",
        "http://internal.aws/admin",
    );
    results.push(blind_ssrf);

    // ━━━ Generate validation report
    generate_report(&results);
    
    Ok(())
}