#!/usr/bin/env bash
set -euo pipefail

# CASAN H5 Governance Harness
# Usage:
#   governance-check.sh <input-file> <output-file> [action-name]
#
# Non-interactive by default. High-risk actions are denied unless:
#   CASAN_APPROVAL_DECISION=approve CASAN_APPROVER=<name>

INPUT_FILE="${1:-}"
OUTPUT_FILE="${2:-}"
ACTION_NAME="${3:-agent_step}"

if [[ -z "$INPUT_FILE" || -z "$OUTPUT_FILE" ]]; then
  echo "Usage: governance-check.sh <input-file> <output-file> [action-name]" >&2
  exit 64
fi

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/casan-paths.sh"
PROJECT_ROOT="$CASAN_APP_ROOT"
LOG_DIR="$CASAN_STATE_ROOT/logs"
TRACE_DIR="$LOG_DIR/trace"
AUDIT_DIR="$LOG_DIR/audit"
mkdir -p "$TRACE_DIR" "$AUDIT_DIR" "$(dirname "$OUTPUT_FILE")"

if [[ ! -f "$INPUT_FILE" ]]; then
  echo "GOVERNANCE_DENIED: input file not found: $INPUT_FILE" >&2
  exit 1
fi

timestamp() {
  date -u +"%Y-%m-%dT%H:%M:%SZ"
}

new_trace_id() {
  if command -v uuidgen >/dev/null 2>&1; then
    uuidgen | tr '[:upper:]' '[:lower:]'
  else
    printf 'trace-%s-%s\n' "$(date +%s)" "$$"
  fi
}

hash_text() {
  if command -v sha256sum >/dev/null 2>&1; then
    sha256sum | awk '{print $1}'
  else
    shasum -a 256 | awk '{print $1}'
  fi
}

json_escape() {
  python -c 'import json,sys; print(json.dumps(sys.stdin.read()))' 2>/dev/null || sed 's/\\/\\\\/g; s/"/\\"/g'
}

TRACE_ID="$(new_trace_id)"
TIMESTAMP="$(timestamp)"
INPUT="$(cat "$INPUT_FILE")"
LOWER_INPUT="$(printf '%s' "$INPUT" | tr '[:upper:]' '[:lower:]')"
ACTOR="${CASAN_ACTOR:-${CASAN_AGENT:-}}"
APPROVER="${CASAN_APPROVER:-}"
APPROVAL_DECISION="${CASAN_APPROVAL_DECISION:-auto}"
AUDIT_LOG="$AUDIT_DIR/audit.jsonl"

RISK_LEVEL="low"
REASONS=()
ACTION_CLASS="unknown"
RISK_FACTORS_JSON='{"action_risk":"high","content_risk":"high","environment_risk":"low","identity_risk":"low","resource_risk":"low"}'
EVIDENCE_REQUIREMENT="required"
RISK_POLICY_DECISION="require_approval"
KERNEL_CLI="$CASAN_HARNESS_ROOT/scripts/python/kernel_cli.py"
RISK_JSON=""
RISK_RC=0
if [[ -f "$KERNEL_CLI" ]]; then
  RISK_JSON="$(python3 "$KERNEL_CLI" risk --action "$ACTION_NAME" --tool "$ACTION_NAME" \
    --content-file "$INPUT_FILE" --actor "$ACTOR" --environment "${CASAN_PROFILE:-development}" 2>/dev/null)" || RISK_RC=$?
else
  RISK_RC=127
fi
if [[ "$RISK_RC" -eq 0 && -n "$RISK_JSON" ]]; then
  RISK_FIELDS="$(python3 - "$RISK_JSON" <<'PY'
import json, sys
payload = json.loads(sys.argv[1])
print("\t".join([
    str(payload["action_class"]),
    str(payload["effective_risk"]),
    json.dumps(payload["risk_factors"], sort_keys=True, separators=(",", ":")),
    str(payload["evidence_requirement"]),
    str(payload["decision"]),
]))
PY
)" || RISK_RC=$?
fi
if [[ "$RISK_RC" -eq 0 && -n "${RISK_FIELDS:-}" ]]; then
  IFS=$'\t' read -r ACTION_CLASS RISK_LEVEL RISK_FACTORS_JSON EVIDENCE_REQUIREMENT RISK_POLICY_DECISION <<< "$RISK_FIELDS"
  REASONS+=("action-risk-floor:$ACTION_CLASS")
else
  RISK_LEVEL="high"
  ACTION_CLASS="unknown"
  RISK_POLICY_DECISION="require_approval"
  REASONS+=("action-risk-classifier-failed-closed")
fi

APPROVAL_STATUS="auto_approved"
DECISION="approved"

if [[ "$RISK_LEVEL" == "medium" ]]; then
  APPROVAL_STATUS="policy_auto_approved_with_audit"
fi

if [[ "$RISK_POLICY_DECISION" == "deny" ]]; then
  APPROVAL_STATUS="actor_identity_required"
  DECISION="denied"
  REASONS+=("actor-identity-required")
elif [[ "$RISK_LEVEL" == "high" || "$RISK_LEVEL" == "critical" || "$RISK_POLICY_DECISION" == "require_approval" ]]; then
  APPROVAL_STRICT_EFFECTIVE="${CASAN_APPROVAL_STRICT:-0}"
  [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_PROFILE:-}" == "production" || "${CASAN_PROFILE:-}" == "strict" ]] && APPROVAL_STRICT_EFFECTIVE="1"
  if [[ "$APPROVAL_STRICT_EFFECTIVE" == "1" ]]; then
    # Approval-identity mode (V20): an env-var approver is NOT enough — the
    # reviewer must cryptographically SIGN this exact request and their role must
    # be authorized for the action. SoD (actor != approver) still enforced.
    if [[ "$APPROVAL_DECISION" == "approve" && -n "$APPROVER" && ( -n "${CASAN_APPROVAL_SIG:-}" || -n "${CASAN_APPROVAL_JWT:-}" ) ]]; then
      if [[ "$APPROVER" == "$ACTOR" ]]; then
        APPROVAL_STATUS="separation_of_duties_violation"
        DECISION="denied"
        REASONS+=("separation-of-duties:actor-equals-approver")
      else
        AV_RC=0
        AV_OUT="$(bash "$SCRIPT_DIR/approval-verify.sh" "$ACTION_NAME" "$ACTOR" "$INPUT_FILE" "$APPROVER" "${CASAN_APPROVAL_SIG:-"-"}" 2>/dev/null)" || AV_RC=$?
        if [[ "$AV_RC" -eq 0 ]]; then
          if printf '%s' "$AV_OUT" | grep -q "mechanism=oidc"; then
            APPROVAL_STATUS="human_approved_oidc"
          else
            APPROVAL_STATUS="human_approved_signed"
          fi
          DECISION="approved"
          REASONS+=("signed-approval:${AV_OUT#APPROVAL_OK }")
        else
          APPROVAL_STATUS="approval_signature_invalid"
          DECISION="denied"
          REASONS+=("signed-approval-failed")
        fi
      fi
    else
      APPROVAL_STATUS="approval_required_signed"
      DECISION="denied"
      REASONS+=("strict-requires-signed-approval")
    fi
  elif [[ "$APPROVAL_DECISION" == "approve" && -n "$APPROVER" ]]; then
    if [[ "$APPROVER" == "$ACTOR" ]]; then
      # Separation of duties: the submitter may not approve their own action.
      APPROVAL_STATUS="separation_of_duties_violation"
      DECISION="denied"
      REASONS+=("separation-of-duties:actor-equals-approver")
    else
      APPROVAL_STATUS="human_approved"
      DECISION="approved"
    fi
  else
    APPROVAL_STATUS="approval_required"
    DECISION="denied"
  fi
fi

INPUT_HASH="$(printf '%s' "$INPUT" | hash_text)"
OUTPUT_CONTENT="$INPUT"
OUTPUT_HASH="$(printf '%s' "$OUTPUT_CONTENT" | hash_text)"
PREV_HASH=""
if [[ -s "$AUDIT_LOG" ]]; then
  PREV_HASH="$(tail -n 1 "$AUDIT_LOG" | sed -n 's/.*"record_hash":"\([^"]*\)".*/\1/p')"
fi

REASONS_JSON="$(printf '%s\n' "${REASONS[@]:-}" | python -c 'import json,sys; print(json.dumps([x for x in sys.stdin.read().splitlines() if x]))')"
# approver and output_hash are part of the hashed core so they cannot be
# silently mutated after the fact.
RECORD_CORE="$(printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s|%s' "$TIMESTAMP" "$TRACE_ID" "$ACTION_NAME" "$ACTION_CLASS" "$ACTOR" "$RISK_LEVEL" "$RISK_FACTORS_JSON" "$EVIDENCE_REQUIREMENT" "$DECISION" "$APPROVAL_STATUS" "$APPROVER" "$INPUT_HASH" "$OUTPUT_HASH" "$PREV_HASH")"
RECORD_HASH="$(printf '%s' "$RECORD_CORE" | hash_text)"

TRACE_FILE="$TRACE_DIR/governance-$TRACE_ID.json"
# SEC-05 (H-04): serialize both the standalone trace file and the appended audit
# chain line via json.dumps. Previously ACTOR/APPROVER/ACTION_NAME were interpolated
# raw, so a value containing `"` + newline could inject a SECOND forged audit record
# (a fabricated "approved" decision). The record_hash is still computed from
# RECORD_CORE above, so verify-audit-chain.sh recomputes and matches unchanged.
# SEC-29 (X-05): the audit write must FAIL CLOSED. If the audit log cannot be
# written (disk full, read-only, quota), there must be NO governed action without
# its accountability record — deny and empty the output rather than proceed.
if ! CASAN_GC_REASONS="$REASONS_JSON" python - "$TRACE_FILE" "$AUDIT_LOG" \
  "$TIMESTAMP" "$TRACE_ID" "$ACTION_NAME" "$ACTION_CLASS" "$ACTOR" "$RISK_LEVEL" \
  "$RISK_FACTORS_JSON" "$EVIDENCE_REQUIREMENT" "$DECISION" "$APPROVAL_STATUS" \
  "$APPROVER" "$INPUT_HASH" "$OUTPUT_HASH" "$PREV_HASH" "$RECORD_HASH" <<'PY'
import json, os, sys
(trace_file, audit_log, ts, trace_id, action, action_class, actor, risk,
 risk_factors_json, evidence_requirement, decision, approval_status, approver,
 input_hash, output_hash, prev_hash, record_hash) = sys.argv[1:]
try:
    reasons = json.loads(os.environ.get("CASAN_GC_REASONS") or "[]")
except ValueError:
    reasons = []
rec = {
    "schema_version": 2, "category": "runtime_control",
    "timestamp": ts, "trace_id": trace_id, "harness": "H5-governance",
    "action": action, "action_class": action_class, "actor": actor,
    "risk_level": risk, "effective_risk": risk,
    "risk_factors": json.loads(risk_factors_json),
    "evidence_requirement": evidence_requirement, "decision": decision,
    "approval_status": approval_status, "approver": approver,
    "input_hash": input_hash, "output_hash": output_hash,
    "previous_record_hash": prev_hash, "record_hash": record_hash,
}
trace = {**rec, "reasons": reasons}
with open(trace_file, "w", encoding="utf-8") as f:
    json.dump(trace, f, indent=2)
    f.write("\n")
with open(audit_log, "a", encoding="utf-8") as f:
    # Compact separators: the chain line is regex-parsed elsewhere and must match
    # the original printf format (no space after ':' / ',').
    f.write(json.dumps(rec, separators=(",", ":")) + "\n")
    f.flush()
    os.fsync(f.fileno())
PY
then
  : > "$OUTPUT_FILE" 2>/dev/null || true
  echo "GOVERNANCE_DENIED trace_id=$TRACE_ID reason=audit_unwritable (fail-closed: no governed action without an audit record)" >&2
  exit 2
fi

# --- External anchor: cryptographically sign the new chain head ---
# A re-forged chain (recomputed hashes) changes the head; without the private
# key the attacker cannot produce a matching signature, so verification fails.
# Development may use a local key for self-contained demonstration. Production
# refuses that path unless an explicit emergency override is visible in evidence.
PRODUCTION_PROFILE=0
[[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_PROFILE:-}" == "production" || "${CASAN_PROFILE:-}" == "strict" ]] && PRODUCTION_PROFILE=1
EMERGENCY_TRUST_OVERRIDE="${CASAN_TRUST_EMERGENCY_OVERRIDE:-0}"
TRUST_LOG="$CASAN_STATE_ROOT/logs/readiness/trust-capabilities.jsonl"
mkdir -p "$(dirname "$TRUST_LOG")"

if [[ "$PRODUCTION_PROFILE" == "1" && "$EMERGENCY_TRUST_OVERRIDE" != "1" ]]; then
  TRUST_RC=0
  TRUST_JSON="$(python3 "$KERNEL_CLI" trust-capabilities 2>/dev/null)" || TRUST_RC=$?
  if [[ "$TRUST_RC" -ne 0 ]]; then
    if [[ -n "$TRUST_JSON" ]]; then
      printf '%s\n' "$TRUST_JSON" >> "$TRUST_LOG"
    else
      printf '{"ready":false,"severity":"critical","reason_codes":["production_trust_configuration_invalid"]}\n' >> "$TRUST_LOG"
    fi
    : > "$OUTPUT_FILE"
    echo "GOVERNANCE_DENIED trace_id=$TRACE_ID reason=production_trust_root_unavailable" >&2
    exit 2
  fi
  printf '%s\n' "$TRUST_JSON" >> "$TRUST_LOG"
  if ! bash "$SCRIPT_DIR/sign-audit-head.sh" "$AUDIT_LOG" >/dev/null 2>&1; then
    : > "$OUTPUT_FILE"
    echo "GOVERNANCE_DENIED trace_id=$TRACE_ID reason=external_signing_failed" >&2
    exit 2
  fi
  if ! bash "$SCRIPT_DIR/audit-ship-s3.sh" "$AUDIT_DIR/audit-head.txt" >/dev/null 2>&1; then
    : > "$OUTPUT_FILE"
    echo "GOVERNANCE_DENIED trace_id=$TRACE_ID reason=external_immutable_anchor_failed" >&2
    exit 2
  fi
else
  if [[ "$PRODUCTION_PROFILE" == "1" ]]; then
    printf '{"schema_version":"1.0.0","profile":"production","ready":false,"certifiable":false,"emergency_override":true,"severity":"critical","reason_codes":["emergency_local_trust_override_active"]}\n' >> "$TRUST_LOG"
    echo "CRITICAL: emergency local trust override active; execution cannot be production-certified" >&2
  fi
if command -v openssl >/dev/null 2>&1; then
  # Private signing key lives OFF-REPO (default ~/.casan/audit-keys); only the
  # public key is committed. Production: replace with KMS/HSM.
  PUB_DIR="$CASAN_GOVERNANCE_ROOT"
  PRIV_DIR="${CASAN_AUDIT_KEY_DIR:-$HOME/.casan/audit-keys}"
  AUDIT_PRIV="$PRIV_DIR/audit-private.pem"
  AUDIT_PUB="$PUB_DIR/audit-public.pem"
  mkdir -p "$PUB_DIR" "$PRIV_DIR"
  if [[ ! -f "$AUDIT_PRIV" ]]; then
    if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_PROFILE:-}" == "production" || "${CASAN_PROFILE:-}" == "strict" || "${CASAN_VERIFY_STRICT:-}" == "1" ]]; then
      # SEC-02 (H-02): in enforced mode NEVER auto-generate a local signing key.
      # A freshly-minted key next to the data lets any file-writer re-sign a forged
      # head. Prod must provision the key out-of-band (KMS/HSM — see sign-audit-head.sh
      # Vault path). With no key we skip signing; the head stays unsigned and SEC-01
      # strict verification then FAILS CLOSED.
      echo "AUDIT_SIGN_SKIPPED_ENFORCED no off-repo/KMS key provisioned; head left unsigned (verify fails closed)" >&2
    else
      openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$AUDIT_PRIV" 2>/dev/null
      chmod 600 "$AUDIT_PRIV"
    fi
  fi
  if [[ -f "$AUDIT_PRIV" ]]; then
    # Always re-export the public key so it matches the private key we sign with.
    # Without this, a private key that PERSISTS on a CI runner drifts out of sync
    # with a freshly checked-out audit-public.pem (e.g. one committed after a
    # Vault-KMS signing), and verify-audit-chain.sh would reject a genuine head.
    openssl rsa -in "$AUDIT_PRIV" -pubout -out "$AUDIT_PUB" 2>/dev/null || true
    printf '%s' "$RECORD_HASH" > "$AUDIT_DIR/audit-head.txt"
    openssl dgst -sha256 -sign "$AUDIT_PRIV" -out "$AUDIT_DIR/audit-head.sig" "$AUDIT_DIR/audit-head.txt" 2>/dev/null || true
  fi
fi
fi

if [[ "$DECISION" != "approved" ]]; then
  : > "$OUTPUT_FILE"
  echo "GOVERNANCE_DENIED trace_id=$TRACE_ID risk=$RISK_LEVEL approval_status=$APPROVAL_STATUS" >&2
  exit 2
fi

printf '%s\n' "$OUTPUT_CONTENT" > "$OUTPUT_FILE"
echo "GOVERNANCE_APPROVED trace_id=$TRACE_ID risk=$RISK_LEVEL approval_status=$APPROVAL_STATUS output=$OUTPUT_FILE"