#!/bin/bash
# PAX-Coder Security Status Verification
#
# Reports the complete security posture:
# - Release integrity
# - Release signature
# - Node identity
# - Capability presence
# - Capability validity
# - Protected execution status
#
# Exit codes:
#   0 = All checks passed (authorized)
#   1 = At least one check failed

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(dirname "$SCRIPT_DIR")"
SOVEREIGN_DIR="$REPO_ROOT/sovereign"

PASS_COUNT=0
FAIL_COUNT=0

echo "=========================================="
echo "PAX-CODER SECURITY STATUS REPORT"
echo "=========================================="
echo ""

# ============================================================================
# Check 1: Release Integrity
# ============================================================================

echo "Release Integrity Check"
if "$SCRIPT_DIR/verify-clone" > /tmp/pax-integrity.txt 2>&1; then
  INTEGRITY_STATUS="PASS"
  PASS_COUNT=$((PASS_COUNT+1))
  echo "    ✓ PASS"
else
  INTEGRITY_STATUS="FAIL"
  FAIL_COUNT=$((FAIL_COUNT+1))
  echo "    ✗ FAIL"
fi

rm -f /tmp/pax-integrity.txt
echo ""

# ============================================================================
# Check 2: Release Signature
# ============================================================================

echo "Release Signature Check"

if [ -f "$SOVEREIGN_DIR/release.json" ]; then
  if grep -q '"signature_hex"' "$SOVEREIGN_DIR/release.json"; then
    SIGNATURE_STATUS="PASS"
    PASS_COUNT=$((PASS_COUNT+1))
    echo "    ✓ PASS (signature present in release.json)"
  else
    SIGNATURE_STATUS="FAIL"
    FAIL_COUNT=$((FAIL_COUNT+1))
    echo "    ✗ FAIL (signature missing)"
  fi
else
  SIGNATURE_STATUS="UNAVAILABLE"
  echo "    ⊘ UNAVAILABLE (no release.json)"
fi

echo ""

# ============================================================================
# Check 3: Node Identity
# ============================================================================

echo "Node Identity Check"

if [ -f "$SOVEREIGN_DIR/node.json" ] && [ -f "$SOVEREIGN_DIR/node_pk.pem" ]; then
  NODE_STATUS="PASS"
  PASS_COUNT=$((PASS_COUNT+1))
  NODE_ID=$(grep '"node_id"' "$SOVEREIGN_DIR/node.json" 2>/dev/null | cut -d'"' -f4 || echo "unknown")
  echo "    ✓ PASS"
  echo "      Node ID: $NODE_ID"
else
  NODE_STATUS="FAIL"
  FAIL_COUNT=$((FAIL_COUNT+1))
  echo "    ✗ FAIL (node.json or node_pk.pem missing)"
fi

echo ""

# ============================================================================
# Check 4: Capability Presence
# ============================================================================

echo "Capability Presence Check"

CAPABILITY_TOKEN="${PAX_CAPABILITY_TOKEN:-}"
CAPABILITY_FILE="$SOVEREIGN_DIR/.capability"

if [ -n "$CAPABILITY_TOKEN" ] || [ -f "$CAPABILITY_FILE" ]; then
  CAPABILITY_PRESENT="YES"
  echo "    ✓ YES (capability available)"
else
  CAPABILITY_PRESENT="NO"
  echo "    ✗ NO (capability not available)"
fi

echo ""

# ============================================================================
# Check 5: Capability Validity (if present)
# ============================================================================

echo "Capability Validity Check"

if [ "$CAPABILITY_PRESENT" = "YES" ]; then
  if [ -n "$CAPABILITY_TOKEN" ]; then
    CAPABILITY="$CAPABILITY_TOKEN"
  else
    CAPABILITY=$(cat "$CAPABILITY_FILE" 2>/dev/null || echo "")
  fi

  # Parse expiration time
  CAPABILITY_EXPIRES=$(echo "$CAPABILITY" | grep -o '"expires_at":"[^"]*"' | cut -d'"' -f4 || echo "")

  if [ -z "$CAPABILITY_EXPIRES" ]; then
    CAPABILITY_VALIDITY_STATUS="FAIL"
    FAIL_COUNT=$((FAIL_COUNT+1))
    echo "    ✗ FAIL (expiration not found)"
  else
    # Check if expired
    CURRENT_TIME=$(date +%s 2>/dev/null || echo "0")
    EXPIRATION_TIME=$(date -d "$CAPABILITY_EXPIRES" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%SZ" "$CAPABILITY_EXPIRES" +%s 2>/dev/null || echo "0")

    if [ "$CURRENT_TIME" -le "$EXPIRATION_TIME" ]; then
      CAPABILITY_VALIDITY_STATUS="VALID"
      PASS_COUNT=$((PASS_COUNT+1))
      echo "    ✓ VALID"
      echo "      Expires: $CAPABILITY_EXPIRES"
    else
      CAPABILITY_VALIDITY_STATUS="EXPIRED"
      FAIL_COUNT=$((FAIL_COUNT+1))
      echo "    ✗ EXPIRED"
      echo "      Expired: $CAPABILITY_EXPIRES"
    fi
  fi
else
  CAPABILITY_VALIDITY_STATUS="N/A"
  echo "    ⊘ N/A (no capability)"
fi

echo ""

# ============================================================================
# Check 6: Capability Signature
# ============================================================================

echo "Capability Signature Check"

if [ "$CAPABILITY_PRESENT" = "YES" ]; then
  CAPABILITY_SIGNATURE=$(echo "$CAPABILITY" | cut -d'|' -f2 || echo "")

  if [ -z "$CAPABILITY_SIGNATURE" ]; then
    SIGNATURE_CHECK_STATUS="FAIL"
    FAIL_COUNT=$((FAIL_COUNT+1))
    echo "    ✗ FAIL (signature missing)"
  elif echo "$CAPABILITY_SIGNATURE" | grep -qE '^[a-f0-9]{128}$'; then
    SIGNATURE_CHECK_STATUS="PASS"
    PASS_COUNT=$((PASS_COUNT+1))
    echo "    ✓ PASS (signature format valid)"
  else
    SIGNATURE_CHECK_STATUS="FAIL"
    FAIL_COUNT=$((FAIL_COUNT+1))
    echo "    ✗ FAIL (signature format invalid)"
  fi
else
  SIGNATURE_CHECK_STATUS="N/A"
  echo "    ⊘ N/A (no capability)"
fi

echo ""

# ============================================================================
# Check 7: Protected Execution Authorization
# ============================================================================

echo "Protected Execution Authorization"

if [ "$INTEGRITY_STATUS" = "PASS" ] && [ "$CAPABILITY_VALIDITY_STATUS" = "VALID" ] && [ "$SIGNATURE_CHECK_STATUS" = "PASS" ]; then
  EXECUTION_STATUS="AUTHORIZED"
  echo "    ✓ AUTHORIZED"
  echo ""
  echo "    You may execute protected operations:"
  echo "      - generate_node_key"
  echo "      - generate_release"
else
  EXECUTION_STATUS="DENIED"
  echo "    ✗ DENIED"
  echo ""

  if [ "$INTEGRITY_STATUS" != "PASS" ]; then
    echo "    Reason: Release integrity verification failed"
  fi

  if [ "$CAPABILITY_PRESENT" = "NO" ]; then
    echo "    Reason: Capability not available"
  elif [ "$CAPABILITY_VALIDITY_STATUS" = "EXPIRED" ]; then
    echo "    Reason: Capability expired"
  elif [ "$SIGNATURE_CHECK_STATUS" = "FAIL" ]; then
    echo "    Reason: Capability signature invalid"
  fi
fi

echo ""

# ============================================================================
# Summary
# ============================================================================

echo "=========================================="
echo "SUMMARY"
echo "=========================================="
echo ""
echo "Release Integrity:       $INTEGRITY_STATUS"
echo "Release Signature:       $SIGNATURE_STATUS"
echo "Node Identity:           $NODE_STATUS"
echo "Capability:              $CAPABILITY_PRESENT"
echo "Capability Validity:     $CAPABILITY_VALIDITY_STATUS"
echo "Capability Signature:    $SIGNATURE_CHECK_STATUS"
echo "Protected Execution:     $EXECUTION_STATUS"
echo ""
echo "Passed: $PASS_COUNT | Failed: $FAIL_COUNT"
echo ""

if [ $FAIL_COUNT -eq 0 ] && [ "$EXECUTION_STATUS" = "AUTHORIZED" ]; then
  exit 0
else
  exit 1
fi