const puppeteer=require('puppeteer');
const SUSPECT=/horse\.pacim\.de|pacim|egress|exitIp|X-Api-Key|sk_(ipi|api)_/i;
(async()=>{
const b=await puppeteer.launch({headless:'new',args:['--no-sandbox','--disable-setuid-sandbox','--host-resolver-rules=MAP www.safemyident.de 127.0.0.1','--ignore-certificate-errors']});
async function audit(url, act){
  const p=await b.newPage();
  await p.setCookie({name:'wordpress_logged_in_8ee7c555d1ecbc630d9be8fb20481a97',value:process.env.CVAL,domain:'www.safemyident.de',path:'/',httpOnly:true,secure:true});
  const reqHosts=new Set(); const external=[]; const leakBodies=[];
  p.on('request',r=>{ try{const h=new URL(r.url()).host; reqHosts.add(h); if(!/^www\.safemyident\.de$/.test(h) && !/^(data|blob)$/.test(h) && r.url().indexOf('data:')!==0) external.push(r.method()+' '+r.url());}catch(e){} });
  p.on('response',async r=>{ try{const ct=r.headers()['content-type']||''; if(/json|text/.test(ct)){const t=await r.text(); if(SUSPECT.test(t)) leakBodies.push(r.url()+' :: '+t.slice(0,200));}}catch(e){} });
  await p.goto(url,{waitUntil:'networkidle2',timeout:60000});
  await act(p).catch(e=>{});
  await new Promise(r=>setTimeout(r,3500));
  console.log('--- '+url);
  console.log('  hosts contacted:', [...reqHosts].join(', '));
  console.log('  EXTERNAL (non-same-origin) requests:', external.length?external:'NONE');
  console.log('  response bodies leaking host/secret:', leakBodies.length?leakBodies:'NONE');
  await p.close();
}
// Identity generator – echte Generierung (kein Mock)
await audit('https://www.safemyident.de/tools/identitaets-generator/', async p=>{ await p.click('#smi-idg-submit'); await p.waitForFunction(()=>document.querySelector('.smi-idg__card'),{timeout:20000}); });
// IP-Check – echter Scan
await audit('https://www.safemyident.de/tools/ip-check/', async p=>{ const btn=await p.$('button[type=submit], .smi-ipc__btn, #smi-ipc-submit'); if(btn) await btn.click(); await new Promise(r=>setTimeout(r,6000)); });
await b.close();
})().catch(e=>{console.error('ERR',e.message);process.exit(1);});