#!/usr/bin/env bash
# ============================================================================
# NoData — sidecar pre-check (offline subset)
#
# SCOPE — read this before you conclude anything about NoData's proofs.
# This script checks a *content-signature sidecar* (*.nodatasig, issued by
# /sign). That is one of two chains, and it is the weaker one: its links are
# symmetric HMAC, so a full chain verify needs a server roundtrip.
#
# The chain that carries operator and decision receipts does NOT work this way.
# Those receipts are Ed25519-signed, carry signing_pubkey_hex inline, are sealed
# hourly into a Merkle epoch (RFC 6962), the epoch root is published to a witness
# feed outside our infrastructure (github.com/proofbydefault/witness-feed) and
# anchored into Bitcoin via OpenTimestamps. You verify those with standard
# libraries, fully offline, with NoData nowhere in the loop:
#   https://www.nodatacapsule.com/proof-stack/verify-yourself
#
# Validates the structural integrity of a *.nodatasig sidecar without
# contacting NoData servers:
#   - JSON parses
#   - schema = nodatasig.v1
#   - all required fields present
#   - content_hash format valid
#   - chain_hmac is hex-32-bytes
#   - file's actual SHA-256 matches the sidecar's content_hash
#
# This is NOT a full verify (a sidecar's chain HMAC is symmetric, so
# confirming its position needs a server roundtrip — see audit-chain-spec.md
# §10; this is a property of the sidecar chain, not of receipts).
# It is a 100%-offline sanity check that catches local tampering instantly.
#
# Usage: ./verify-offline.sh secret-roadmap.pdf
# Requires: jq, openssl
# ============================================================================

set -e

if [ -z "$1" ]; then
  echo "Usage: $0 <file>" >&2
  exit 2
fi

FILE="$1"
SIG="${FILE}.nodatasig"

if [ ! -f "$FILE" ]; then echo "ERROR: file not found: $FILE" >&2; exit 1; fi
if [ ! -f "$SIG" ];  then echo "ERROR: sidecar not found: $SIG" >&2; exit 1; fi

# Parse sidecar
schema=$(jq -r '.schema' "$SIG")
content_hash=$(jq -r '.content_hash' "$SIG")
chain_hmac=$(jq -r '.chain_hmac' "$SIG")
receipt_id=$(jq -r '.receipt_id' "$SIG")

# Schema check
if [ "$schema" != "nodatasig.v1" ]; then
  echo "FAIL: unexpected schema '$schema'"
  exit 1
fi

# Required fields
for field in receipt_id chain_index actor_nickname signed_at; do
  if [ "$(jq -r ".$field" "$SIG")" = "null" ]; then
    echo "FAIL: required sidecar field missing: $field"
    exit 1
  fi
done

# Hash format
if ! [[ "$content_hash" =~ ^sha256:[a-f0-9]{64}$ ]]; then
  echo "FAIL: invalid content_hash format"
  exit 1
fi
if ! [[ "$chain_hmac" =~ ^[a-f0-9]{64}$ ]]; then
  echo "FAIL: invalid chain_hmac format (expected 32 bytes hex)"
  exit 1
fi

# Recompute file hash
expected="${content_hash#sha256:}"
actual=$(openssl dgst -sha256 -binary "$FILE" | xxd -p -c 999)

if [ "$expected" != "$actual" ]; then
  echo "FAIL: file SHA-256 does not match sidecar"
  echo "  expected: $expected"
  echo "  actual:   $actual"
  echo ""
  echo "→ this means the file has been modified since signing"
  exit 1
fi

echo "OFFLINE-CHECK PASS: structural OK, content_hash matches"
echo "  receipt_id:  $receipt_id"
echo "  next step:   curl https://www.nodatacapsule.com/api/verify -d @<(jq '{content_hash,sidecar:.}' '$SIG')"
echo "  for full chain HMAC verify of this sidecar (requires network)"
echo ""
echo "  Verifying a RECEIPT instead? That needs nothing from us:"
echo "    https://www.nodatacapsule.com/proof-stack/verify-yourself"
echo "    git clone https://github.com/proofbydefault/witness-feed"