#!/usr/bin/env bash
# SAFE DEFENSIVE VALIDATOR — WORLD-WRITABLE FILES/DIRS PROOF
#
# Purpose: Finds world-writable files and directories (limited depth and paths)
#          to prove excessive permissions surface. Read-only find only.
#
# Safety: Strict limits (maxdepth 3 on /, specific safe paths). No modification.
#
# Generated by Vigil safe-poc-generator (Phase 1, template A).

set -euo pipefail

STARTED=$(date -u +%Y-%m-%dT%H:%M:%SZ)
ROOT=${1:-/}

echo '{
  "validator": "world-writable-validator",
  "schemaVersion": "1.0.0",
  "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
  "startedAt": "'"$STARTED"'",
  "root": "'"$ROOT"'",
  "worldWritableFiles": [],'

# Bounded safe search
FILES=$(find "$ROOT" -xdev -maxdepth 3 -type f -perm -o+w 2>/dev/null | head -20 | sed 's/"/\\"/g' || true)
DIRS=$(find "$ROOT" -xdev -maxdepth 3 -type d -perm -o+w 2>/dev/null | head -15 | sed 's/"/\\"/g' || true)

echo '  "filesSample": ['"$(echo "$FILES" | sed 's/^/"/;s/$/"/' | paste -sd,)"'],
  "dirsSample": ['"$(echo "$DIRS" | sed 's/^/"/;s/$/"/' | paste -sd,)"'],
  "completedAt": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
  "conclusion": "World-writable surface enumerated locally. Review for sensitive data or binaries."
}'
exit 0