#!/usr/bin/env bash
# MASON-WP-0005-T05 — operator-side proof of the fluid-telegram operator lane.
#
#   ./scripts/verify-fluid-telegram-lane.sh member      # sign in as a fluid-telegram-operators member (aal2)
#   ./scripts/verify-fluid-telegram-lane.sh non-member  # sign in as someone outside the group
#
# Logs in on the lane's OIDC role, asks OpenBao what the token may do on each
# path (sys/capabilities-self: names only, never a value), revokes the token,
# and writes a 0600 receipt. The token is held in a shell variable only: never
# printed, never stored in the token helper, so your own session is untouched.
# The login URL appears on stderr as usual; only the token goes to stdout.
set -euo pipefail

export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
ROLE=fluid-telegram-hall-of-helix-workload-kv
BASE=platform/data/workloads/coulomb/fluid-telegram/hall-of-helix
RECEIPTS="$(getent passwd "$(id -u)" | cut -d: -f6)/.local/state/railiance/receipts"
mode="${1:-}"
case "$mode" in member|non-member) ;; *) echo "usage: $0 member|non-member" >&2; exit 2 ;; esac

umask 077
mkdir -p "$RECEIPTS"
receipt="$RECEIPTS/fluid-telegram-lane-$mode.txt"
echo "Sign in as the $mode identity in your browser (URL below). Use a private window so" >&2
echo "an existing KeyCape session (e.g. platform-root) is not reused." >&2

if ! token="$(bao login -token-only -method=oidc -path=netkingdom role="$ROLE")" || [ -z "$token" ]; then
    { echo "mode=$mode at=$(date -u +%FT%TZ)"; echo "login=refused"; } > "$receipt"
    if [ "$mode" = non-member ]; then
        echo "login refused, as expected for a non-member; receipt: $receipt" >&2
    else
        echo "login REFUSED for the member run. If the browser reused another KeyCape session" >&2
        echo "(e.g. platform-root), retry in a private window signed in as a group member." >&2
    fi
    [ "$mode" = non-member ] && exit 0 || exit 1
fi

{
    echo "mode=$mode at=$(date -u +%FT%TZ)"
    echo "login=ok"
    for p in \
        "$BASE/operator-app" "$BASE/operator-session" "$BASE/bot-token" "$BASE/redaction-salt" \
        "platform/data/workloads/coulomb/fluid-telegram/hall-of-helix" \
        "platform/data/workloads/coulomb/fluid-telegram/other-campaign/bot-token" \
        "platform/data/workloads/coulomb/whynot-design/npm-publish" \
        "platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" \
        "platform/data/workloads/keycape/secrets-engine-openbao" \
        "sys/policies/acl/agent-high-risk-boundary"; do
        echo "$p: $(BAO_TOKEN="$token" bao token capabilities "$p" 2>/dev/null || echo error)"
    done
    echo "policies=$(BAO_TOKEN="$token" bao token lookup -format=json 2>/dev/null | python3 -c 'import json,sys; print(",".join(json.load(sys.stdin)["data"]["policies"]))' || echo error)"
} > "$receipt"
BAO_TOKEN="$token" bao token revoke -self >/dev/null 2>&1 && echo "revoked=yes" >> "$receipt" || echo "revoked=FAILED" >> "$receipt"
unset token
echo "receipt: $receipt" >&2
[ "$mode" = member ]