#!/usr/bin/env bash
set -uo pipefail

# CASAN Plan-16 SEC-17 (ARCH-03) — CASAN_PROFILE=prod is secure-by-default.
#
# Many strong controls were opt-in env flags (off unless explicitly set), so a
# lazy operator ran permissively. Under CASAN_PROFILE=prod they now default ON —
# while an explicit `=0` still wins (internal scans that disable a flag on purpose
# must stay disabled). Proven across three real controls:
#   * verify-audit-chain: unsigned chain fails under prod,
#   * control-plane verify-audit: unsigned store fails under prod,
#   * casan-harness kill-switch: engaged switch is enforced under prod, but an
#     explicit CASAN_KILLSWITCH_ENFORCE=0 overrides.
#
# Deterministic; hermetic (temp dirs); no model/network.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
BASH_DIR="$PROJECT_ROOT/.specify/scripts/bash"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT

PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }

echo "===== Plan-16 SEC-17: CASAN_PROFILE=prod secure-by-default ====="

# --- Control 1: verify-audit-chain (unsigned) ---
AUD="$WORK/audit"; mkdir -p "$AUD"
python3 - "$AUD/audit.jsonl" <<'PY'
import hashlib, json, sys
core = "|".join(["2026-07-06T00:00:00Z","t1","act","a@x","low","ALLOW","n/a","","ih","oh",""])
h = hashlib.sha256(core.encode()).hexdigest()
open(sys.argv[1],"w").write(json.dumps({"timestamp":"2026-07-06T00:00:00Z","trace_id":"t1","action":"act",
  "actor":"a@x","risk_level":"low","decision":"ALLOW","approval_status":"n/a","approver":"",
  "input_hash":"ih","output_hash":"oh","previous_record_hash":"","record_hash":h})+"\n")
PY
[[ "$(rc_of bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -eq 0 ]] \
  && pass "verify-audit-chain: permissive default allows unsigned" || fail "permissive should allow unsigned"
[[ "$(rc_of env CASAN_PROFILE=prod bash "$BASH_DIR/verify-audit-chain.sh" "$AUD/audit.jsonl")" -ne 0 ]] \
  && pass "verify-audit-chain: prod profile enforces (unsigned FAILS)" || fail "prod did not enforce audit-chain"

# --- Control 2: control-plane verify-audit (unsigned store) ---
export CASAN_CP_STORE_FILE="$WORK/cp.json" CASAN_CP_KEY_DIR="$WORK/cpkeys" CASAN_CP_PUB="$WORK/cp.pub"
python3 "$BASH_DIR/control-plane-settings.py" set compression.enabled true --actor a --reason r >/dev/null 2>&1
rm -f "$WORK/cp.json.head" "$WORK/cp.json.head.sig" "$WORK/cp.pub"   # strip the signature -> unsigned store
[[ "$(rc_of python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -eq 0 ]] \
  && pass "control-plane: permissive default allows unsigned store" || fail "permissive should allow unsigned store"
[[ "$(rc_of env CASAN_PROFILE=prod python3 "$BASH_DIR/control-plane-settings.py" verify-audit)" -ne 0 ]] \
  && pass "control-plane: prod profile enforces (unsigned store FAILS)" || fail "prod did not enforce control-plane"
unset CASAN_CP_STORE_FILE CASAN_CP_KEY_DIR CASAN_CP_PUB

# --- Control 3: casan-harness kill-switch (prod-on + explicit-0-wins) ---
export CASAN_KILLSWITCH_DIR="$WORK/ks"
echo "hi" > "$WORK/in.txt"
bash "$BASH_DIR/kill-switch.sh" engage project sec17 "test" >/dev/null 2>&1

OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o.txt" act -- bash -c 'echo x' 2>&1)"
echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
  && pass "kill-switch: prod profile enforces an engaged switch (no explicit flag)" \
  || fail "prod profile did not enforce kill-switch"

OUT="$(set +e; CASAN_PROFILE=prod CASAN_KILLSWITCH_ENFORCE=0 CASAN_KILLSWITCH_SCOPE=project CASAN_KILLSWITCH_ID=sec17 \
  bash "$BASH_DIR/casan-harness.sh" "$WORK/in.txt" "$WORK/o2.txt" act -- bash -c 'echo x' 2>&1)"
echo "$OUT" | grep -q "KILL_SWITCH_ACTIVE" \
  && fail "explicit CASAN_KILLSWITCH_ENFORCE=0 was overridden by prod (should win)" \
  || pass "kill-switch: explicit =0 overrides prod default (internal opt-out preserved)"

echo ""
echo "===== SEC-17 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1