#!/usr/bin/env bash
set -uo pipefail

# CASAN Plan-16 SEC-06 (H-06) — control-plane audit head is SIGNED.
#
# The control-plane audit chain is a recomputable hash chain: a file-writer who
# edits the store could recompute every hash and the chain-only `verify-audit`
# would still PASS, so governance-report would falsely report CERTIFIED. Signing
# the head with an off-repo key closes this:
#   * an intact signed store verifies (permissive + strict),
#   * a recompute-tampered store FAILS (signature no longer matches the head),
#   * a fully unsigned store FAILS in enforced mode (governance-report inherits
#     CASAN_PROFILE=prod, so a certified run demands a signature).
#
# Deterministic; hermetic (temp store + temp keys + temp pubkey).

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
PROJECT_ROOT="$CASAN_APP_ROOT"
CP="$CASAN_HARNESS_ROOT/scripts/bash/control-plane-settings.py"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT

export CASAN_CP_STORE_FILE="$WORK/store.json"
export CASAN_CP_KEY_DIR="$WORK/keys"
export CASAN_CP_PUB="$WORK/cp-public.pem"   # provisioned out-of-band (attacker cannot rewrite in this test)

PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }
rc_of() { set +e; "$@" >/dev/null 2>&1; echo $?; set -e 2>/dev/null || true; }

echo "===== Plan-16 SEC-06: control-plane audit head signed ====="

python3 "$CP" set compression.enabled true --actor a@x --reason r >/dev/null 2>&1
python3 "$CP" set compression.mode structural --actor a@x --reason r >/dev/null 2>&1

[[ "$(rc_of python3 "$CP" verify-audit)" -eq 0 ]] \
  && pass "intact signed store verifies (permissive)" || fail "intact store rejected"
[[ "$(rc_of env CASAN_VERIFY_STRICT=1 python3 "$CP" verify-audit)" -eq 0 ]] \
  && pass "intact signed store verifies (strict)" || fail "intact store rejected in strict"

# Recompute-attack: tamper a value AND recompute the entire hash chain so it is
# internally consistent. The head signature (over the original head) must not match.
python3 - "$CASAN_CP_STORE_FILE" <<'PY'
import hashlib, json, sys
p = sys.argv[1]; d = json.load(open(p))
d["settings"]["compression.enabled"]["value"] = False
prev = "0" * 64
def he(e): return hashlib.sha256(json.dumps(e, sort_keys=True, ensure_ascii=False).encode()).hexdigest()
for e in d["audit"]:
    if e.get("key") == "compression.enabled" and e.get("action") == "set":
        e["value"] = False
    rest = {k: v for k, v in e.items() if k != "hash"}; rest["prevHash"] = prev
    for k in list(e):
        if k != "hash": e[k] = rest[k]
    e["hash"] = he(rest); prev = e["hash"]
json.dump(d, open(p, "w"), indent=2)
PY
[[ "$(rc_of python3 "$CP" verify-audit)" -ne 0 ]] \
  && pass "recompute-tampered store FAILS (head signature mismatch)" \
  || fail "recompute attack passed verification (H-06 not closed!)"

# Keyless attacker: delete the signature artifacts entirely. Enforced mode (what a
# certified run / prod profile uses) must reject an unsigned store; dev stays lax.
rm -f "$CASAN_CP_STORE_FILE.head" "$CASAN_CP_STORE_FILE.head.sig" "$CASAN_CP_PUB"
# rebuild a clean, internally-valid but UNSIGNED store (fresh sets would re-sign, so
# strip the signature after): easiest is to reuse the tampered chain which is
# internally valid; with sig files gone it is "unsigned".
[[ "$(rc_of env CASAN_VERIFY_STRICT=1 python3 "$CP" verify-audit)" -ne 0 ]] \
  && pass "unsigned store FAILS in enforced mode (prod / certified run)" \
  || fail "unsigned store accepted in enforced mode"
[[ "$(rc_of python3 "$CP" verify-audit)" -eq 0 ]] \
  && pass "unsigned store still OK in permissive dev mode (backward compat)" \
  || fail "permissive mode wrongly rejected unsigned store"

echo ""
echo "===== SEC-06 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1