#!/bin/bash
echo "============================================"
echo "  INDEPENDENT CRYPTOGRAPHIC VERIFIER"
echo "============================================"

if [ "$#" -ne 2 ]; then
    echo "Usage: ./verify_all.sh <canonical_payload.json> <signature.hex>"
    exit 1
fi

PAYLOAD_FILE=$1
SIG_HEX_FILE=$2
PUB_KEY="authority_public_key.pem"

if [ ! -f "$PAYLOAD_FILE" ]; then
    echo "❌ ERROR: Payload file not found."
    exit 1
fi

if [ ! -f "$SIG_HEX_FILE" ]; then
    echo "❌ ERROR: Signature file not found."
    exit 1
fi

if [ ! -f "$PUB_KEY" ]; then
    echo "❌ ERROR: Public key not found. Please download authority_public_key.pem."
    exit 1
fi

# 1. Verify Payload Hash
echo "[1/4] Verifying Canonical Payload Hash..."
PAYLOAD_HASH=$(sha256sum "$PAYLOAD_FILE" | awk '{print $1}')
echo "      Payload Hash: $PAYLOAD_HASH"

# 2. Verify Canonical Payload is valid JSON
echo "[2/4] Validating Canonical Payload format..."
if ! jq . "$PAYLOAD_FILE" >/dev/null 2>&1; then
    echo "❌ ERROR: Invalid JSON payload."
    exit 1
fi

# 3. Convert Signature hex to bin
xxd -r -p "$SIG_HEX_FILE" signature.bin

# 4. Verify Authority Signature (supports Ed25519 and ECDSA P-256)
echo "[3/4] Verifying Authority Signature..."
openssl pkeyutl -verify -pubin -inkey "$PUB_KEY" -rawin -in "$PAYLOAD_FILE" -sigfile signature.bin > /dev/null 2>&1
if [ $? -eq 0 ]; then
    echo "[4/4] Extracting Boundary Hash..."
    BOUNDARY_HASH=$(jq -r '.boundary_hash // "legacy-hash"' "$PAYLOAD_FILE")
    echo "      Boundary Hash: $BOUNDARY_HASH"
    
    echo "============================================"
    echo "✅ PASS: Record is authentic and verified."
    echo "============================================"
    rm -f signature.bin
    exit 0
else
    echo "============================================"
    echo "❌ FAIL: Cryptographic verification failed."
    echo "============================================"
    rm -f signature.bin
    exit 1
fi