#!/bin/bash
set -euo pipefail

ROOT="${PRUVA_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
LOGS="$ROOT/logs"
mkdir -p "$LOGS"

REPO="$ROOT/external/libjwt"
VULN_BUILD="$REPO/build_vuln"
FIX_BUILD="$REPO/build_fix"

# Build the vulnerable version if not already built
if [ ! -f "$VULN_BUILD/libjwt.so" ]; then
    echo "[*] Building vulnerable libjwt v3.3.2 ..."
    cd "$REPO"
    git checkout v3.3.2
    mkdir -p "$VULN_BUILD"
    cd "$VULN_BUILD"
    cmake .. -DCMAKE_BUILD_TYPE=Release
    make -j$(nproc)
fi

# Build the fixed version if not already built
if [ ! -f "$FIX_BUILD/libjwt.so" ]; then
    echo "[*] Building fixed libjwt v3.3.3 ..."
    cd "$REPO"
    git checkout v3.3.3
    mkdir -p "$FIX_BUILD"
    cd "$FIX_BUILD"
    cmake .. -DCMAKE_BUILD_TYPE=Release
    make -j$(nproc)
fi

# Compile the harness against the vulnerable build
echo "[*] Compiling harness against vulnerable libjwt ..."
cd "$ROOT"
cc -I"$REPO/include" -I"$VULN_BUILD" -L"$VULN_BUILD" -Wl,-rpath,"$VULN_BUILD" -o "$ROOT/repro/harness_vuln" "$ROOT/repro/harness.c" -ljwt -ljansson -lssl -lcrypto

# Run the harness against the vulnerable build
echo "[*] Running harness against vulnerable libjwt v3.3.2 ..."
set +e
LD_LIBRARY_PATH="$VULN_BUILD" "$ROOT/repro/harness_vuln" > "$LOGS/vuln_out.txt" 2>&1
VULN_EXIT=$?
set -e
echo "    Exit code: $VULN_EXIT"

# Compile the harness against the fixed build
echo "[*] Compiling harness against fixed libjwt ..."
cd "$ROOT"
cc -I"$REPO/include" -I"$FIX_BUILD" -L"$FIX_BUILD" -Wl,-rpath,"$FIX_BUILD" -o "$ROOT/repro/harness_fix" "$ROOT/repro/harness.c" -ljwt -ljansson -lssl -lcrypto

# Run the harness against the fixed build
echo "[*] Running harness against fixed libjwt v3.3.3 ..."
set +e
LD_LIBRARY_PATH="$FIX_BUILD" "$ROOT/repro/harness_fix" > "$LOGS/fix_out.txt" 2>&1
FIX_EXIT=$?
set -e
echo "    Exit code: $FIX_EXIT"

# Save combined results
cat > "$LOGS/results.txt" <<ENDRESULTS
Vulnerable build (v3.3.2) exit code: $VULN_EXIT
Fixed build (v3.3.3) exit code: $FIX_EXIT

Vulnerable output:
$(cat "$LOGS/vuln_out.txt")

Fixed output:
$(cat "$LOGS/fix_out.txt")
ENDRESULTS

# Validate results
echo ""
if [ "$VULN_EXIT" -eq 0 ]; then
    echo "[VULNERABLE] v3.3.2 accepted RSA JWK for HS256 and verified forged token"
else
    echo "[UNEXPECTED] v3.3.2 did not verify forged token (exit=$VULN_EXIT)"
fi

if [ "$FIX_EXIT" -ne 0 ]; then
    echo "[FIXED] v3.3.3 rejected RSA JWK for HS256 (exit=$FIX_EXIT)"
else
    echo "[UNEXPECTED] v3.3.3 verified forged token (exit=$FIX_EXIT)"
fi

# Final verdict
if [ "$VULN_EXIT" -eq 0 ] && [ "$FIX_EXIT" -ne 0 ]; then
    echo ""
    echo "=== VERDICT: CONFIRMED ==="
    cat > "$ROOT/repro/validation_verdict.json" <<ENDVERDICT
{
  "verdict": "confirmed",
  "vulnerable_version": "3.3.2",
  "fixed_version": "3.3.3",
  "vulnerable_indicator": "forged HS256 token verified successfully against RSA JWK (no alg) on v3.3.2",
  "fixed_indicator": "RSA JWK rejected for HS256 algorithm on v3.3.3",
  "vuln_exit_code": $VULN_EXIT,
  "fix_exit_code": $FIX_EXIT
}
ENDVERDICT
    exit 0
else
    echo ""
    echo "=== VERDICT: UNEXPECTED RESULTS ==="
    exit 1
fi