#!/usr/bin/env python3
"""Claim 1: certificate-chain authority.

Issue a three-tier chain (self-signed root, organisational signer, leaf
capability certificate) with Ed25519 signatures, verify the chain to the
trusted root, and show that a tampered, expired, or wrongly-issued
certificate FAILS verification.
"""

import dataclasses
import sys
from datetime import timedelta
from pathlib import Path

sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))

from capability_licensing import CertificateAuthority, verify_chain
from capability_licensing.certificates import parse_iso

failures = []


def check(label: str, condition: bool, evidence: str) -> None:
    marker = "ok " if condition else "FAIL"
    print(f"  [{marker}] {label}")
    print(f"         {evidence}")
    if not condition:
        failures.append(label)


def main() -> int:
    print("=== Claim 1: certificate-chain authority (issue and verify) ===\n")

    authority = CertificateAuthority()
    root = authority.create_root("Reference Root Authority")
    organisation = authority.issue_organisation(root.serial, "Reference Research Organisation")
    capability, _capability_key = authority.issue_capability(
        organisation.serial,
        "structured-document-summarisation",
        claims={
            "capability": "structured-document-summarisation",
            "grant": "research demonstration only",
        },
    )

    print(f"  issued root:         {root.serial}  (self-signed, Ed25519)")
    print(f"  issued organisation: {organisation.serial}  (signed by root)")
    print(f"  issued capability:   {capability.serial}  (signed by organisation)")
    print()

    # 1. The intact chain verifies to the trusted root.
    intact = verify_chain(capability, [organisation], [root])
    check(
        "intact chain verifies to the trusted root",
        intact.valid,
        f"result: {'VALID' if intact.valid else 'INVALID'} - {intact.reason} "
        f"(path: {' -> '.join(intact.path)})",
    )

    # 2. A tampered certificate fails: edit the grant terms after signing.
    tampered = dataclasses.replace(
        capability,
        claims={**dict(capability.claims), "grant": "unlimited production use"},
    )
    tampered_result = verify_chain(tampered, [organisation], [root])
    check(
        "tampered certificate (grant terms edited after signing) fails",
        not tampered_result.valid and "does not verify" in tampered_result.reason,
        f"result: INVALID - {tampered_result.reason}",
    )

    # 3. An expired certificate fails: verify one day after its not_after.
    after_expiry = parse_iso(capability.not_after) + timedelta(days=1)
    expired_result = verify_chain(capability, [organisation], [root], at=after_expiry)
    check(
        "expired certificate (checked one day after expiry) fails",
        not expired_result.valid and "expired" in expired_result.reason,
        f"result: INVALID - {expired_result.reason}",
    )

    # 4. A chain from a different, untrusted authority fails against our
    #    trust store, even though it is internally well-formed.
    other_authority = CertificateAuthority()
    other_root = other_authority.create_root("Unaccredited Authority")
    other_org = other_authority.issue_organisation(other_root.serial, "Unaccredited Organisation")
    other_leaf, _ = other_authority.issue_capability(
        other_org.serial, "impersonated-capability", claims={}
    )
    wrong_issuer_result = verify_chain(other_leaf, [other_org, other_root], [root])
    check(
        "certificate chained to an untrusted root fails",
        not wrong_issuer_result.valid and "not in the trust store" in wrong_issuer_result.reason,
        f"result: INVALID - {wrong_issuer_result.reason}",
    )

    print()
    if failures:
        print(f"RESULT: FAIL - {len(failures)} check(s) did not behave as claimed")
        return 1
    print(
        "RESULT: PASS - the chain verifies offline against the trust store, and "
        "tampering, expiry, and an untrusted issuer each fail verification"
    )
    return 0


if __name__ == "__main__":
    sys.exit(main())