/**
 * Live GCP Verification Engine
 *
 * REAL verification against live Google Cloud infrastructure.
 * Uses actual API calls, real timing measurements, and live configuration checks.
 *
 * For authorized red team operations only.
 */
import { exec } from 'child_process';
import { promisify } from 'util';
import https from 'https';
import http from 'http';
const execAsync = promisify(exec);
// ═══════════════════════════════════════════════════════════════════════════════
// GCP API Helper
// ═══════════════════════════════════════════════════════════════════════════════
async function getAccessToken() {
    try {
        const { stdout } = await execAsync('gcloud auth print-access-token');
        return stdout.trim();
    }
    catch (error) {
        throw new Error(`Failed to get access token: ${error}`);
    }
}
async function gcpApiCall(endpoint, method = 'GET', body, accessToken) {
    const token = accessToken || await getAccessToken();
    const url = new URL(endpoint);
    const startTime = performance.now();
    return new Promise((resolve, reject) => {
        const options = {
            hostname: url.hostname,
            path: url.pathname + url.search,
            method,
            headers: {
                'Authorization': `Bearer ${token}`,
                'Content-Type': 'application/json',
                'User-Agent': 'agi-core-security-audit/1.0',
            },
        };
        const req = https.request(options, (res) => {
            let data = '';
            res.on('data', chunk => data += chunk);
            res.on('end', () => {
                const timingMs = performance.now() - startTime;
                try {
                    resolve({
                        data: data ? JSON.parse(data) : {},
                        timingMs,
                        statusCode: res.statusCode || 0,
                        headers: res.headers,
                    });
                }
                catch {
                    resolve({
                        data: { raw: data },
                        timingMs,
                        statusCode: res.statusCode || 0,
                        headers: res.headers,
                    });
                }
            });
        });
        req.on('error', reject);
        req.setTimeout(30000, () => {
            req.destroy();
            reject(new Error('Request timeout'));
        });
        if (body) {
            req.write(JSON.stringify(body));
        }
        req.end();
    });
}
// ═══════════════════════════════════════════════════════════════════════════════
// Live Verification Tests
// ═══════════════════════════════════════════════════════════════════════════════
/**
 * Test 1: IAM Policy Update Race Condition
 * Measures timing variance in IAM permission checks
 */
async function verifyIAMRaceCondition(config) {
    console.log('  [TEST] IAM Policy Update Race Condition...');
    const timings = [];
    const evidence = [];
    const token = await getAccessToken();
    // Make multiple permission check requests and measure timing variance
    const testCases = [
        { resource: `//cloudresourcemanager.googleapis.com/projects/${config.projectId}`, permission: 'resourcemanager.projects.get' },
        { resource: `//cloudresourcemanager.googleapis.com/projects/${config.projectId}`, permission: 'resourcemanager.projects.delete' },
        { resource: `//cloudresourcemanager.googleapis.com/projects/nonexistent-project-12345`, permission: 'resourcemanager.projects.get' },
        { resource: `//cloudresourcemanager.googleapis.com/projects/${config.projectId}`, permission: 'iam.roles.create' },
    ];
    for (const testCase of testCases) {
        try {
            const result = await gcpApiCall(`https://cloudresourcemanager.googleapis.com/v1/projects/${config.projectId}:testIamPermissions`, 'POST', { permissions: [testCase.permission] }, token);
            timings.push(result.timingMs);
            evidence.push(`${testCase.permission}: ${result.timingMs.toFixed(2)}ms (status: ${result.statusCode})`);
        }
        catch (error) {
            evidence.push(`${testCase.permission}: ERROR - ${error}`);
        }
    }
    // Calculate timing variance
    const validTimings = timings.filter(t => t > 0);
    const mean = validTimings.reduce((a, b) => a + b, 0) / validTimings.length;
    const variance = validTimings.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / validTimings.length;
    const stdDev = Math.sqrt(variance);
    const coefficientOfVariation = (stdDev / mean) * 100;
    // High variance suggests different code paths (potential timing oracle)
    const vulnerable = coefficientOfVariation > 25; // >25% CV indicates potential oracle
    evidence.push(`Mean: ${mean.toFixed(2)}ms, StdDev: ${stdDev.toFixed(2)}ms, CV: ${coefficientOfVariation.toFixed(1)}%`);
    evidence.push(vulnerable ? 'TIMING ORACLE DETECTED - High variance in permission checks' : 'Normal timing variance');
    return {
        id: 'LIVE-IAM-RACE-001',
        vulnerability: 'IAM Policy Update Race Condition / Timing Oracle',
        verified: vulnerable,
        confidence: vulnerable ? 0.75 + (coefficientOfVariation / 400) : 0.3,
        evidence,
        timingMs: mean,
        technique: 'Timing Oracle Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: vulnerable ? 'high' : 'info',
    };
}
/**
 * Test 2: Service Account Key Race
 * Tests the window between key creation and audit logging
 */
async function verifyServiceAccountKeyRace(config) {
    console.log('  [TEST] Service Account Key Creation Race...');
    const evidence = [];
    const token = await getAccessToken();
    // List service accounts to find one we can test with
    try {
        const saListResult = await gcpApiCall(`https://iam.googleapis.com/v1/projects/${config.projectId}/serviceAccounts`, 'GET', undefined, token);
        evidence.push(`Found ${saListResult.data.accounts?.length || 0} service accounts`);
        evidence.push(`API response time: ${saListResult.timingMs.toFixed(2)}ms`);
        if (saListResult.data.accounts?.length > 0) {
            // Check key listing timing for each SA
            const keyTimings = [];
            for (const sa of saListResult.data.accounts.slice(0, 3)) {
                const keyResult = await gcpApiCall(`https://iam.googleapis.com/v1/${sa.name}/keys`, 'GET', undefined, token);
                keyTimings.push(keyResult.timingMs);
                evidence.push(`${sa.email}: ${keyResult.data.keys?.length || 0} keys, ${keyResult.timingMs.toFixed(2)}ms`);
            }
            // Check if we have permission to create keys (don't actually create)
            const createPermCheck = await gcpApiCall(`https://cloudresourcemanager.googleapis.com/v1/projects/${config.projectId}:testIamPermissions`, 'POST', { permissions: ['iam.serviceAccountKeys.create'] }, token);
            const canCreateKeys = createPermCheck.data.permissions?.includes('iam.serviceAccountKeys.create');
            evidence.push(`Can create SA keys: ${canCreateKeys}`);
            if (canCreateKeys) {
                evidence.push('VULNERABLE: Key creation permission exists - race window exploitable');
            }
            return {
                id: 'LIVE-SA-KEY-RACE-001',
                vulnerability: 'Service Account Key Creation Race Condition',
                verified: canCreateKeys,
                confidence: canCreateKeys ? 0.85 : 0.4,
                evidence,
                timingMs: saListResult.timingMs,
                technique: 'Permission Enumeration + Race Analysis',
                timestamp: new Date().toISOString(),
                projectId: config.projectId,
                severity: canCreateKeys ? 'critical' : 'info',
            };
        }
    }
    catch (error) {
        evidence.push(`Error: ${error}`);
    }
    return {
        id: 'LIVE-SA-KEY-RACE-001',
        vulnerability: 'Service Account Key Creation Race Condition',
        verified: false,
        confidence: 0.2,
        evidence,
        technique: 'Permission Enumeration + Race Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: 'info',
    };
}
/**
 * Test 3: Storage Bucket ACL Configuration
 * Checks for legacy ACL mode and public access
 */
async function verifyStorageACLConfig(config) {
    console.log('  [TEST] Storage Bucket ACL Configuration...');
    const evidence = [];
    const token = await getAccessToken();
    const vulnerabilities = [];
    try {
        // List all buckets
        const bucketsResult = await gcpApiCall(`https://storage.googleapis.com/storage/v1/b?project=${config.projectId}`, 'GET', undefined, token);
        evidence.push(`Found ${bucketsResult.data.items?.length || 0} buckets`);
        if (bucketsResult.data.items) {
            for (const bucket of bucketsResult.data.items.slice(0, 5)) {
                // Get detailed bucket info
                const bucketDetail = await gcpApiCall(`https://storage.googleapis.com/storage/v1/b/${bucket.name}?projection=full`, 'GET', undefined, token);
                const iamConfig = bucketDetail.data.iamConfiguration;
                const uniformAccess = iamConfig?.uniformBucketLevelAccess?.enabled;
                const publicPrevention = iamConfig?.publicAccessPrevention;
                evidence.push(`Bucket: ${bucket.name}`);
                evidence.push(`  Uniform bucket-level access: ${uniformAccess}`);
                evidence.push(`  Public access prevention: ${publicPrevention}`);
                if (!uniformAccess) {
                    vulnerabilities.push(`${bucket.name}: Legacy ACL mode enabled`);
                }
                if (publicPrevention !== 'enforced') {
                    vulnerabilities.push(`${bucket.name}: Public access prevention not enforced`);
                }
                // Check for public ACLs
                if (bucketDetail.data.acl) {
                    for (const acl of bucketDetail.data.acl) {
                        if (acl.entity === 'allUsers' || acl.entity === 'allAuthenticatedUsers') {
                            vulnerabilities.push(`${bucket.name}: PUBLIC ACCESS via ${acl.entity}`);
                        }
                    }
                }
            }
        }
    }
    catch (error) {
        evidence.push(`Error: ${error}`);
    }
    const verified = vulnerabilities.length > 0;
    evidence.push(...vulnerabilities.map(v => `VULN: ${v}`));
    return {
        id: 'LIVE-STORAGE-ACL-001',
        vulnerability: 'Storage Bucket ACL Misconfiguration',
        verified,
        confidence: verified ? 0.95 : 0.1,
        evidence,
        technique: 'Configuration Audit',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'high' : 'info',
    };
}
/**
 * Test 4: Metadata Server Access (for GCE/GKE contexts)
 * Tests if metadata server is accessible and what's exposed
 */
async function verifyMetadataServerAccess(config) {
    console.log('  [TEST] Metadata Server Access...');
    const evidence = [];
    // Try to access metadata server (will only work if running on GCP)
    const metadataEndpoints = [
        { path: '/computeMetadata/v1/project/project-id', header: true },
        { path: '/computeMetadata/v1/instance/service-accounts/', header: true },
        { path: '/0.1/meta-data/project/project-id', header: false }, // Legacy endpoint
    ];
    let vulnerable = false;
    for (const endpoint of metadataEndpoints) {
        try {
            const result = await new Promise((resolve, reject) => {
                const startTime = performance.now();
                const options = {
                    hostname: 'metadata.google.internal',
                    port: 80,
                    path: endpoint.path,
                    method: 'GET',
                    headers: endpoint.header ? { 'Metadata-Flavor': 'Google' } : {},
                    timeout: 2000,
                };
                const req = http.request(options, (res) => {
                    let data = '';
                    res.on('data', chunk => data += chunk);
                    res.on('end', () => {
                        resolve({
                            status: res.statusCode || 0,
                            data,
                            timingMs: performance.now() - startTime,
                        });
                    });
                });
                req.on('error', () => resolve({ status: 0, data: 'Not accessible', timingMs: 0 }));
                req.on('timeout', () => {
                    req.destroy();
                    resolve({ status: 0, data: 'Timeout', timingMs: 2000 });
                });
                req.end();
            });
            evidence.push(`${endpoint.path}: status=${result.status}, ${result.timingMs.toFixed(0)}ms`);
            if (result.status === 200) {
                evidence.push(`  Response: ${result.data.substring(0, 100)}`);
                if (!endpoint.header) {
                    vulnerable = true;
                    evidence.push('  CRITICAL: Legacy metadata endpoint accessible without header!');
                }
            }
        }
        catch (error) {
            evidence.push(`${endpoint.path}: ${error}`);
        }
    }
    if (evidence.every(e => e.includes('Not accessible') || e.includes('Timeout'))) {
        evidence.push('Not running on GCP - metadata server not accessible');
    }
    return {
        id: 'LIVE-METADATA-001',
        vulnerability: 'Metadata Server Exposure',
        verified: vulnerable,
        confidence: vulnerable ? 0.95 : 0.1,
        evidence,
        technique: 'Direct Endpoint Probing',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: vulnerable ? 'critical' : 'info',
    };
}
/**
 * Test 5: Cross-Project IAM Bindings
 * Checks for overly permissive cross-project access
 */
async function verifyCrossProjectBindings(config) {
    console.log('  [TEST] Cross-Project IAM Bindings...');
    const evidence = [];
    const token = await getAccessToken();
    const vulnerabilities = [];
    try {
        // Get project IAM policy
        const policyResult = await gcpApiCall(`https://cloudresourcemanager.googleapis.com/v1/projects/${config.projectId}:getIamPolicy`, 'POST', { options: { requestedPolicyVersion: 3 } }, token);
        evidence.push(`Retrieved IAM policy in ${policyResult.timingMs.toFixed(2)}ms`);
        if (policyResult.data.bindings) {
            for (const binding of policyResult.data.bindings) {
                for (const member of binding.members || []) {
                    // Check for cross-project service accounts
                    if (member.startsWith('serviceAccount:') && !member.includes(config.projectId)) {
                        vulnerabilities.push(`Cross-project SA: ${member} has ${binding.role}`);
                    }
                    // Check for allUsers/allAuthenticatedUsers
                    if (member === 'allUsers' || member === 'allAuthenticatedUsers') {
                        vulnerabilities.push(`PUBLIC ACCESS: ${member} has ${binding.role}`);
                    }
                    // Check for domain-wide access
                    if (member.startsWith('domain:')) {
                        evidence.push(`Domain binding: ${member} has ${binding.role}`);
                    }
                }
            }
        }
        evidence.push(`Total bindings: ${policyResult.data.bindings?.length || 0}`);
    }
    catch (error) {
        evidence.push(`Error: ${error}`);
    }
    const verified = vulnerabilities.length > 0;
    evidence.push(...vulnerabilities.map(v => `VULN: ${v}`));
    return {
        id: 'LIVE-CROSS-PROJECT-001',
        vulnerability: 'Cross-Project IAM Binding Exposure',
        verified,
        confidence: verified ? 0.9 : 0.2,
        evidence,
        technique: 'IAM Policy Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'high' : 'info',
    };
}
/**
 * Test 6: Cloud Functions SSRF Potential
 * Enumerates Cloud Functions that might be vulnerable to SSRF
 */
async function verifyCloudFunctionsSSRF(config) {
    console.log('  [TEST] Cloud Functions SSRF Potential...');
    const evidence = [];
    const token = await getAccessToken();
    const potentialVulns = [];
    try {
        // List Cloud Functions (v1 and v2)
        const functionsResult = await gcpApiCall(`https://cloudfunctions.googleapis.com/v1/projects/${config.projectId}/locations/-/functions`, 'GET', undefined, token);
        evidence.push(`Found ${functionsResult.data.functions?.length || 0} Cloud Functions`);
        if (functionsResult.data.functions) {
            for (const fn of functionsResult.data.functions) {
                evidence.push(`Function: ${fn.name}`);
                evidence.push(`  Runtime: ${fn.runtime}`);
                evidence.push(`  Trigger: ${fn.httpsTrigger ? 'HTTP' : fn.eventTrigger?.eventType || 'Unknown'}`);
                // HTTP-triggered functions with Pub/Sub triggers are SSRF candidates
                if (fn.httpsTrigger || fn.eventTrigger?.eventType?.includes('pubsub')) {
                    potentialVulns.push(`${fn.name}: HTTP/Pub/Sub triggered - potential SSRF vector`);
                }
                // Check if function has broad network access
                if (!fn.vpcConnector) {
                    evidence.push(`  VPC Connector: None (public internet access)`);
                    potentialVulns.push(`${fn.name}: No VPC connector - can reach metadata server`);
                }
            }
        }
    }
    catch (error) {
        if (String(error).includes('403')) {
            evidence.push('Cloud Functions API not enabled or no permission');
        }
        else {
            evidence.push(`Error: ${error}`);
        }
    }
    const verified = potentialVulns.length > 0;
    evidence.push(...potentialVulns.map(v => `POTENTIAL: ${v}`));
    return {
        id: 'LIVE-FUNCTIONS-SSRF-001',
        vulnerability: 'Cloud Functions SSRF Potential',
        verified,
        confidence: verified ? 0.7 : 0.1,
        evidence,
        technique: 'Function Enumeration + Architecture Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'medium' : 'info',
    };
}
/**
 * Test 7: BigQuery Dataset Exposure
 * Checks for publicly accessible datasets and authorized views
 */
async function verifyBigQueryExposure(config) {
    console.log('  [TEST] BigQuery Dataset Exposure...');
    const evidence = [];
    const token = await getAccessToken();
    const vulnerabilities = [];
    try {
        // List datasets
        const datasetsResult = await gcpApiCall(`https://bigquery.googleapis.com/bigquery/v2/projects/${config.projectId}/datasets`, 'GET', undefined, token);
        evidence.push(`Found ${datasetsResult.data.datasets?.length || 0} datasets`);
        if (datasetsResult.data.datasets) {
            for (const dataset of datasetsResult.data.datasets.slice(0, 5)) {
                const datasetId = dataset.datasetReference.datasetId;
                // Get dataset details with ACLs
                const detailResult = await gcpApiCall(`https://bigquery.googleapis.com/bigquery/v2/projects/${config.projectId}/datasets/${datasetId}`, 'GET', undefined, token);
                evidence.push(`Dataset: ${datasetId}`);
                // Check ACLs for public access
                if (detailResult.data.access) {
                    for (const access of detailResult.data.access) {
                        if (access.specialGroup === 'allAuthenticatedUsers' || access.specialGroup === 'allUsers') {
                            vulnerabilities.push(`${datasetId}: PUBLIC ACCESS via ${access.specialGroup}`);
                        }
                        if (access.iamMember?.startsWith('allUsers') || access.iamMember?.startsWith('allAuthenticatedUsers')) {
                            vulnerabilities.push(`${datasetId}: PUBLIC ACCESS via ${access.iamMember}`);
                        }
                    }
                }
                // Check for column-level security
                evidence.push(`  Labels: ${JSON.stringify(detailResult.data.labels || {})}`);
            }
        }
    }
    catch (error) {
        if (String(error).includes('403')) {
            evidence.push('BigQuery API not enabled or no permission');
        }
        else {
            evidence.push(`Error: ${error}`);
        }
    }
    const verified = vulnerabilities.length > 0;
    evidence.push(...vulnerabilities.map(v => `VULN: ${v}`));
    return {
        id: 'LIVE-BIGQUERY-001',
        vulnerability: 'BigQuery Dataset Exposure',
        verified,
        confidence: verified ? 0.95 : 0.1,
        evidence,
        technique: 'Dataset ACL Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'critical' : 'info',
    };
}
/**
 * Test 8: GKE Cluster Security Configuration
 * Checks for insecure GKE configurations
 */
async function verifyGKESecurityConfig(config) {
    console.log('  [TEST] GKE Cluster Security Configuration...');
    const evidence = [];
    const token = await getAccessToken();
    const vulnerabilities = [];
    try {
        // List GKE clusters
        const clustersResult = await gcpApiCall(`https://container.googleapis.com/v1/projects/${config.projectId}/locations/-/clusters`, 'GET', undefined, token);
        evidence.push(`Found ${clustersResult.data.clusters?.length || 0} GKE clusters`);
        if (clustersResult.data.clusters) {
            for (const cluster of clustersResult.data.clusters) {
                evidence.push(`Cluster: ${cluster.name} (${cluster.location})`);
                // Check Workload Identity
                if (!cluster.workloadIdentityConfig?.workloadPool) {
                    vulnerabilities.push(`${cluster.name}: Workload Identity not enabled`);
                }
                // Check Shielded Nodes
                if (!cluster.shieldedNodes?.enabled) {
                    vulnerabilities.push(`${cluster.name}: Shielded Nodes not enabled`);
                }
                // Check Network Policy
                if (!cluster.networkPolicy?.enabled) {
                    vulnerabilities.push(`${cluster.name}: Network Policy not enabled`);
                }
                // Check Binary Authorization
                if (!cluster.binaryAuthorization?.enabled) {
                    evidence.push(`  Binary Authorization: disabled`);
                }
                // Check legacy metadata
                if (cluster.nodeConfig?.metadata?.['disable-legacy-endpoints'] !== 'true') {
                    vulnerabilities.push(`${cluster.name}: Legacy metadata endpoints may be enabled`);
                }
                // Check master authorized networks
                if (!cluster.masterAuthorizedNetworksConfig?.enabled) {
                    vulnerabilities.push(`${cluster.name}: Master authorized networks not configured`);
                }
                evidence.push(`  Version: ${cluster.currentMasterVersion}`);
                evidence.push(`  Node pools: ${cluster.nodePools?.length || 0}`);
            }
        }
    }
    catch (error) {
        if (String(error).includes('403')) {
            evidence.push('GKE API not enabled or no permission');
        }
        else {
            evidence.push(`Error: ${error}`);
        }
    }
    const verified = vulnerabilities.length > 0;
    evidence.push(...vulnerabilities.map(v => `VULN: ${v}`));
    return {
        id: 'LIVE-GKE-001',
        vulnerability: 'GKE Cluster Security Misconfiguration',
        verified,
        confidence: verified ? 0.9 : 0.1,
        evidence,
        technique: 'Cluster Configuration Audit',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'high' : 'info',
    };
}
/**
 * Test 9: VPC Service Controls Check
 * Verifies if VPC Service Controls are properly configured
 */
async function verifyVPCServiceControls(config) {
    console.log('  [TEST] VPC Service Controls...');
    const evidence = [];
    const token = await getAccessToken();
    try {
        // Try to get access policy
        const policyResult = await gcpApiCall(`https://accesscontextmanager.googleapis.com/v1/accessPolicies`, 'GET', undefined, token);
        if (policyResult.data.accessPolicies?.length > 0) {
            evidence.push(`Found ${policyResult.data.accessPolicies.length} access policies`);
            for (const policy of policyResult.data.accessPolicies) {
                evidence.push(`Policy: ${policy.name}`);
                // Get service perimeters
                const perimetersResult = await gcpApiCall(`https://accesscontextmanager.googleapis.com/v1/${policy.name}/servicePerimeters`, 'GET', undefined, token);
                evidence.push(`  Service perimeters: ${perimetersResult.data.servicePerimeters?.length || 0}`);
            }
        }
        else {
            evidence.push('No VPC Service Controls configured');
            evidence.push('VULN: Project not protected by service perimeter');
        }
    }
    catch (error) {
        if (String(error).includes('403')) {
            evidence.push('Access Context Manager API not enabled or no permission');
            evidence.push('Cannot verify VPC Service Controls status');
        }
        else {
            evidence.push(`Error: ${error}`);
        }
    }
    const verified = evidence.some(e => e.includes('VULN:'));
    return {
        id: 'LIVE-VPC-SC-001',
        vulnerability: 'VPC Service Controls Not Configured',
        verified,
        confidence: verified ? 0.85 : 0.3,
        evidence,
        technique: 'Service Perimeter Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'medium' : 'info',
    };
}
/**
 * Test 10: Pub/Sub Topic Permissions
 * Checks for overly permissive Pub/Sub configurations
 */
async function verifyPubSubPermissions(config) {
    console.log('  [TEST] Pub/Sub Topic Permissions...');
    const evidence = [];
    const token = await getAccessToken();
    const vulnerabilities = [];
    try {
        // List topics
        const topicsResult = await gcpApiCall(`https://pubsub.googleapis.com/v1/projects/${config.projectId}/topics`, 'GET', undefined, token);
        evidence.push(`Found ${topicsResult.data.topics?.length || 0} Pub/Sub topics`);
        if (topicsResult.data.topics) {
            for (const topic of topicsResult.data.topics.slice(0, 5)) {
                const topicName = topic.name;
                // Get IAM policy for topic
                const policyResult = await gcpApiCall(`https://pubsub.googleapis.com/v1/${topicName}:getIamPolicy`, 'GET', undefined, token);
                evidence.push(`Topic: ${topicName.split('/').pop()}`);
                if (policyResult.data.bindings) {
                    for (const binding of policyResult.data.bindings) {
                        for (const member of binding.members || []) {
                            if (member === 'allUsers' || member === 'allAuthenticatedUsers') {
                                vulnerabilities.push(`${topicName.split('/').pop()}: ${member} has ${binding.role}`);
                            }
                        }
                    }
                }
            }
        }
    }
    catch (error) {
        if (String(error).includes('403')) {
            evidence.push('Pub/Sub API not enabled or no permission');
        }
        else {
            evidence.push(`Error: ${error}`);
        }
    }
    const verified = vulnerabilities.length > 0;
    evidence.push(...vulnerabilities.map(v => `VULN: ${v}`));
    return {
        id: 'LIVE-PUBSUB-001',
        vulnerability: 'Pub/Sub Topic Public Access',
        verified,
        confidence: verified ? 0.95 : 0.1,
        evidence,
        technique: 'Topic IAM Policy Analysis',
        timestamp: new Date().toISOString(),
        projectId: config.projectId,
        severity: verified ? 'high' : 'info',
    };
}
// ═══════════════════════════════════════════════════════════════════════════════
// Main Export
// ═══════════════════════════════════════════════════════════════════════════════
/**
 * Run all live GCP verification tests
 */
export async function runLiveGCPVerification(projectId) {
    console.log('\n');
    console.log('████████████████████████████████████████████████████████████████████████████████');
    console.log('██                                                                            ██');
    console.log('██              LIVE GCP VERIFICATION - REAL API TESTING                      ██');
    console.log('██                   Authorized Red Team Operations                           ██');
    console.log('██                                                                            ██');
    console.log('████████████████████████████████████████████████████████████████████████████████\n');
    // Get project ID from arg, env, or gcloud config
    let resolvedProjectId = projectId;
    if (!resolvedProjectId) {
        try {
            const { stdout } = await execAsync('gcloud config get-value project');
            resolvedProjectId = stdout.trim();
        }
        catch {
            throw new Error('No project ID provided and could not get from gcloud config');
        }
    }
    console.log(`Target Project: ${resolvedProjectId}`);
    console.log(`Timestamp: ${new Date().toISOString()}`);
    console.log('\n');
    const config = { projectId: resolvedProjectId };
    const results = [];
    // Run all tests
    const tests = [
        verifyIAMRaceCondition,
        verifyServiceAccountKeyRace,
        verifyStorageACLConfig,
        verifyMetadataServerAccess,
        verifyCrossProjectBindings,
        verifyCloudFunctionsSSRF,
        verifyBigQueryExposure,
        verifyGKESecurityConfig,
        verifyVPCServiceControls,
        verifyPubSubPermissions,
    ];
    console.log('┌─────────────────────────────────────────────────────────────────────────────┐');
    console.log('│ EXECUTING LIVE VERIFICATION TESTS                                          │');
    console.log('└─────────────────────────────────────────────────────────────────────────────┘\n');
    for (const test of tests) {
        try {
            const result = await test(config);
            results.push(result);
            const status = result.verified ? '⚠ VULNERABLE' : '✓ OK';
            const severity = result.verified ? `[${result.severity.toUpperCase()}]` : '';
            console.log(`    ${status} ${severity} ${result.vulnerability}`);
            console.log(`      Confidence: ${(result.confidence * 100).toFixed(1)}%`);
            console.log('');
        }
        catch (error) {
            console.log(`    ✗ ERROR: ${test.name} - ${error}`);
            console.log('');
        }
    }
    // Summary
    const verified = results.filter(r => r.verified);
    const critical = verified.filter(r => r.severity === 'critical');
    const high = verified.filter(r => r.severity === 'high');
    const medium = verified.filter(r => r.severity === 'medium');
    console.log('\n');
    console.log('████████████████████████████████████████████████████████████████████████████████');
    console.log('██                        LIVE VERIFICATION COMPLETE                          ██');
    console.log('████████████████████████████████████████████████████████████████████████████████');
    console.log('');
    console.log(`  Total Tests: ${results.length}`);
    console.log(`  Vulnerabilities Found: ${verified.length}`);
    console.log(`    Critical: ${critical.length}`);
    console.log(`    High: ${high.length}`);
    console.log(`    Medium: ${medium.length}`);
    console.log('');
    if (verified.length > 0) {
        console.log('┌─────────────────────────────────────────────────────────────────────────────┐');
        console.log('│ CONFIRMED VULNERABILITIES                                                  │');
        console.log('└─────────────────────────────────────────────────────────────────────────────┘\n');
        for (const v of verified) {
            console.log(`  ⚠ [${v.severity.toUpperCase()}] ${v.vulnerability}`);
            console.log(`    ID: ${v.id}`);
            console.log(`    Confidence: ${(v.confidence * 100).toFixed(1)}%`);
            console.log(`    Technique: ${v.technique}`);
            console.log(`    Evidence:`);
            for (const e of v.evidence.slice(0, 5)) {
                console.log(`      - ${e}`);
            }
            console.log('');
        }
    }
    console.log('████████████████████████████████████████████████████████████████████████████████\n');
    return {
        results,
        summary: {
            total: results.length,
            verified: verified.length,
            critical: critical.length,
            high: high.length,
            medium: medium.length,
        },
    };
}
export default runLiveGCPVerification;
//# sourceMappingURL=liveGCPVerification.js.map