#!/usr/bin/env bash
set -uo pipefail

# CASAN — Model-digest pinning (Plan-07 B4 / V16, trust the model backend).
#
# An attacker who swaps or poisons the local model (e.g. re-tags a different
# ornith:9b) changes CASAN's behaviour with no code change. This pins the
# approved model's content digest and refuses (or warns) when the live digest
# no longer matches — so a silent model swap is detected.
#
# Digest source: Ollama /api/tags (real) or CASAN_MODEL_DIGEST (override, for
# CI/tests). If neither is available the check SKIPs (cannot verify).
#
# Usage:
#   model-digest-check.sh pin    [model]   # record the current digest as approved
#   model-digest-check.sh verify [model]   # compare live digest to the pinned one
#   model-digest-check.sh show   [model]
# Env: CASAN_MODEL (default ornith:9b) · CASAN_MODEL_DIGEST (override) ·
#      CASAN_MODEL_DIGEST_PIN (pin file) · OLLAMA_HOST (default 127.0.0.1:11434)
# Exit: 0 match/pinned · 2 MISMATCH (swap detected) · 3 unpinned/undeterminable.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
PIN_FILE="${CASAN_MODEL_DIGEST_PIN:-$PROJECT_ROOT/.specify/security/model-digest.pin}"
mkdir -p "$(dirname "$PIN_FILE")"
CMD="${1:-verify}"
MODEL="${2:-${CASAN_MODEL:-ornith:9b}}"
OLLAMA="${OLLAMA_HOST:-127.0.0.1:11434}"

current_digest() {
  # 1) explicit override (deterministic for CI/tests)
  if [[ -n "${CASAN_MODEL_DIGEST:-}" ]]; then printf '%s' "$CASAN_MODEL_DIGEST"; return 0; fi
  # 2) live Ollama
  local d
  d="$(curl -sf "http://$OLLAMA/api/tags" 2>/dev/null | \
    python3 -c "import json,sys
m=sys.argv[1]
try: d=json.load(sys.stdin)
except Exception: sys.exit(1)
for x in d.get('models',[]):
    if x.get('name')==m: print(x.get('digest','')); break" "$MODEL" 2>/dev/null)"
  [[ -n "$d" ]] && { printf '%s' "$d"; return 0; }
  return 1
}

pinned_digest() { awk -v m="$MODEL" '$1==m {print $2; exit}' "$PIN_FILE" 2>/dev/null; }

case "$CMD" in
  pin)
    D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL (Ollama down + no CASAN_MODEL_DIGEST)" >&2; exit 3; }
    tmp="$(mktemp)"; grep -v "^$MODEL	" "$PIN_FILE" 2>/dev/null > "$tmp" || true
    printf '%s\t%s\n' "$MODEL" "$D" >> "$tmp"; mv "$tmp" "$PIN_FILE"
    echo "MODEL_DIGEST_PINNED model=$MODEL digest=${D:0:24}…"
    ;;
  verify)
    P="$(pinned_digest)"
    [[ -n "$P" ]] || { echo "MODEL_DIGEST_UNPINNED model=$MODEL (run: model-digest-check.sh pin)" >&2; exit 3; }
    D="$(current_digest)" || { echo "MODEL_DIGEST_UNAVAILABLE model=$MODEL — cannot verify" >&2; exit 3; }
    if [[ "$D" == "$P" ]]; then
      echo "MODEL_DIGEST_OK model=$MODEL digest=${D:0:24}…"
      exit 0
    fi
    echo "MODEL_DIGEST_MISMATCH model=$MODEL pinned=${P:0:24}… live=${D:0:24}… — model may have been swapped/poisoned" >&2
    exit 2
    ;;
  show)
    echo "model=$MODEL pinned=$(pinned_digest || echo none) live=$(current_digest || echo unavailable)"
    ;;
  *)
    echo "Usage: model-digest-check.sh {pin|verify|show} [model]" >&2; exit 64 ;;
esac