#!/usr/bin/env php
<?php

/**
 * Session Manipulation Tool for Security Testing
 *
 * This script helps manipulate Laravel session data for IDOR testing
 * as described in references/MANUAL_SECURITY_TESTING_CHECKLIST.md
 *
 * Usage:
 *   php test-session-manipulation.php [session_id] [profile_id] [profile_type]
 *
 * Example:
 *   php test-session-manipulation.php "your-session-id" 2 "App\\Models\\User"
 */

require __DIR__.'/vendor/autoload.php';

$app = require_once __DIR__.'/bootstrap/app.php';
$app->make('Illuminate\Contracts\Console\Kernel')->bootstrap();

if ($argc < 4) {
    echo "Usage: php test-session-manipulation.php [session_id] [profile_id] [profile_type]\n";
    echo "\nExample:\n";
    echo "  php test-session-manipulation.php \"abc123\" 2 \"App\\\\Models\\\\User\"\n";
    echo "\nTo get your session ID:\n";
    echo "  1. Login to the app\n";
    echo "  2. Open DevTools → Storage → Cookies\n";
    echo "  3. Copy the value of 'laravel_session' cookie\n";
    exit(1);
}

$sessionId = $argv[1];
$newProfileId = $argv[2];
$newProfileType = $argv[3];

// Decode the session ID (Laravel encrypts cookies)
$encrypter = app('encrypter');
try {
    $decodedSessionId = $encrypter->decrypt($sessionId, false);
} catch (\Exception $e) {
    echo "ERROR: Could not decrypt session ID. Make sure you copied the entire cookie value.\n";
    echo "Error: " . $e->getMessage() . "\n";
    exit(1);
}

// Get session store
$session = app('session.store');

// Load the session
$session->setId($decodedSessionId);
$session->start();

echo "Current session data:\n";
echo "  activeProfileId: " . ($session->get('activeProfileId') ?? 'NOT SET') . "\n";
echo "  activeProfileType: " . ($session->get('activeProfileType') ?? 'NOT SET') . "\n";
echo "\n";

// Manipulate session
$session->put('activeProfileId', $newProfileId);
$session->put('activeProfileType', $newProfileType);
$session->save();

echo "Session manipulated successfully!\n";
echo "  NEW activeProfileId: $newProfileId\n";
echo "  NEW activeProfileType: $newProfileType\n";
echo "\n";
echo "Now refresh your browser to see the changes.\n";
echo "WARNING: This is for security testing only!\n";