#!/usr/bin/env bash
set -uo pipefail

# CASAN Plan-16 SEC-22 (ARCH-06) — JWT `exp` uses a TRUSTED time source, not the
# manipulable local system clock.
#
# An attacker who can skew the host clock backwards could make an expired approval
# JWT look still-valid. approval-verify.sh now consults CASAN_TRUSTED_TIME /
# CASAN_TRUSTED_TIME_FILE (a trusted timestamp authority) when present. This proves:
#   * a JWT valid by the system clock is still DENIED when trusted-time is past exp,
#   * the same JWT is APPROVED when trusted-time is before exp,
#   * an unreadable trusted-time file fails CLOSED (deny, not fall back to clock),
#   * with no trusted-time set, behaviour is unchanged (backward compatible).
#
# Reuses the real RS256 mint + verify path (openssl + approval-jwt-mint.py).
# Also covers ARCH-08: telemetry-poisoning defence in self-improve (untrusted-source
# tag + enforced apply block). Deterministic; hermetic; no network.
# (ARCH-10 external attestation remains planned — see CASAN_PLAN_16 §0a.)

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
S="$CASAN_HARNESS_ROOT/scripts/bash"
AV="$S/approval-verify.sh"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT

PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }

command -v openssl >/dev/null 2>&1 || { echo "SKIP: openssl unavailable"; exit 0; }

echo "===== Plan-16 SEC-22: trusted-time for JWT exp (ARCH-06) ====="

# IdP keypair + a registry authorizing role 'ops' for action 'deploy'.
openssl genrsa -out "$WORK/idp.priv.pem" 2048 2>/dev/null
openssl rsa -in "$WORK/idp.priv.pem" -pubout -out "$WORK/idp.pub.pem" 2>/dev/null
REG="$WORK/reviewers.registry"; printf 'action deploy ops\n' > "$REG"
REQ="$WORK/req.txt"; printf 'deploy to production\n' > "$REQ"

# JWT valid for +300s by the system clock.
JWT="$(python3 "$S/approval-jwt-mint.py" --key "$WORK/idp.priv.pem" --sub oidc-ops \
  --role ops --action deploy --actor alice --input "$REQ" --exp-offset 300)"

verify() { # extra-env... -> rc
  env CASAN_APPROVAL_JWT="$JWT" CASAN_IDP_PUBLIC_KEY="$WORK/idp.pub.pem" \
      CASAN_REVIEWERS_FILE="$REG" "$@" \
      bash "$AV" deploy alice "$REQ" oidc-ops -
}

NOW="$(date -u +%s)"

# 1) baseline (no trusted-time): valid JWT -> APPROVED.
[[ "$(rc_of verify)" -eq 0 ]] \
  && pass "no trusted-time: valid JWT APPROVED (backward compatible)" \
  || fail "baseline valid JWT rejected"

# 2) trusted-time BEFORE exp -> APPROVED.
[[ "$(rc_of verify CASAN_TRUSTED_TIME="$NOW")" -eq 0 ]] \
  && pass "trusted-time before exp: APPROVED" || fail "trusted-time before exp wrongly denied"

# 3) trusted-time PAST exp -> DENY jwt_expired (even though system clock says valid).
err="$WORK/e.txt"
rc=$(set +e; verify CASAN_TRUSTED_TIME="$((NOW + 100000))" >/dev/null 2>"$err"; echo $?)
[[ "$rc" -eq 3 ]] && grep -q "jwt_expired" "$err" \
  && pass "trusted-time past exp: DENY jwt_expired (clock-skew defeated)" \
  || fail "trusted-time past exp not denied (rc=$rc)"

# 4) unreadable trusted-time file -> fail-closed DENY.
rc=$(set +e; verify CASAN_TRUSTED_TIME_FILE="$WORK/nope.txt" >/dev/null 2>&1; echo $?)
[[ "$rc" -eq 3 ]] \
  && pass "unreadable trusted-time file fails CLOSED (deny)" || fail "trusted-time file error not fail-closed (rc=$rc)"

echo "----- ARCH-08: untrusted-telemetry proposal tag + enforced apply block -----"
SI="$S/self-improve.py"
printf '{"step":"01","cost_usd":0.02}\n{"step":"02","cost_usd":0.08}\n' > "$WORK/metrics.jsonl"

# unsigned telemetry -> proposals tagged source_trust=untrusted
python3 "$SI" propose --metrics "$WORK/metrics.jsonl" > "$WORK/prop-unsigned.json" 2>/dev/null
grep -q '"source_trust": "untrusted"' "$WORK/prop-unsigned.json" \
  && pass "ARCH-08: unsigned telemetry → proposals tagged untrusted" \
  || fail "unsigned telemetry not tagged untrusted"

# validly-signed telemetry -> verified
openssl genrsa -out "$WORK/m.priv.pem" 2048 2>/dev/null
openssl rsa -in "$WORK/m.priv.pem" -pubout -out "$WORK/m.pub.pem" 2>/dev/null
openssl dgst -sha256 -sign "$WORK/m.priv.pem" -out "$WORK/metrics.sig" "$WORK/metrics.jsonl" 2>/dev/null
python3 "$SI" propose --metrics "$WORK/metrics.jsonl" --metrics-sig "$WORK/metrics.sig" \
  --metrics-pub "$WORK/m.pub.pem" > "$WORK/prop-signed.json" 2>/dev/null
grep -q '"source_trust": "verified"' "$WORK/prop-signed.json" \
  && pass "ARCH-08: validly-signed telemetry → verified" || fail "signed telemetry not verified"

# tampered-after-signing -> untrusted (fail-closed)
printf '{"step":"03","cost_usd":9.99}\n' >> "$WORK/metrics.jsonl"
python3 "$SI" propose --metrics "$WORK/metrics.jsonl" --metrics-sig "$WORK/metrics.sig" \
  --metrics-pub "$WORK/m.pub.pem" > "$WORK/prop-tampered.json" 2>/dev/null
grep -q '"source_trust": "untrusted"' "$WORK/prop-tampered.json" \
  && pass "ARCH-08: tampered-after-sign telemetry → untrusted (fail-closed)" || fail "tampered telemetry not caught"

# enforced apply of an untrusted proposal is BLOCKED (even with approval)
rc=$(set +e; CASAN_SELFIMPROVE_STRICT=1 python3 "$SI" apply --proposals "$WORK/prop-unsigned.json" \
  --id P-COST-CAP --approval human-ok >/dev/null 2>"$WORK/si.err"; echo $?)
[[ "$rc" -eq 1 ]] && grep -q "UNTRUSTED_SOURCE" "$WORK/si.err" \
  && pass "ARCH-08: enforced apply of untrusted proposal is BLOCKED" \
  || fail "untrusted proposal not blocked under enforce (rc=$rc)"

# verified proposal passes the untrusted gate under enforce (governed set in temp store)
out="$(set +e; CASAN_CP_STORE_FILE="$WORK/store.json" CASAN_SELFIMPROVE_STRICT=1 python3 "$SI" apply \
  --proposals "$WORK/prop-signed.json" --id P-COST-CAP --approval human-ok 2>&1)"
printf '%s' "$out" | grep -q "UNTRUSTED_SOURCE" \
  && fail "verified proposal wrongly blocked as untrusted" \
  || pass "ARCH-08: verified proposal passes the untrusted gate under enforce"

echo ""
echo "===== SEC-22 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1