Flow 17 – Sign-Then-Encrypt Nested Operations (Compact)

package co.ankatech.ankasecure.sdk.examples;

import co.ankatech.ankasecure.sdk.AuthenticatedSdk;
import co.ankatech.ankasecure.sdk.model.DecryptVerifyResult;
import co.ankatech.ankasecure.sdk.model.SignEncryptResult;
import co.ankatech.ankasecure.sdk.util.FileIO;

import java.nio.file.Path;
import java.util.Properties;

import static co.ankatech.ankasecure.sdk.examples.ExampleUtil.*;

/**
 * Scenario 17 — Sign-Then-Encrypt Nested Operations, Compact (data-plane).
 *
 * <p>Demonstrates the proper sequence for authenticated encryption: signing plaintext first (inner layer)
 * then encrypting the signature (outer layer). This is the recommended pattern for secure messaging
 * where both authenticity and confidentiality are required.</p>
 *
 * <h3>Why Sign-THEN-Encrypt?</h3>
 * <ul>
 *   <li><strong>Authenticity + Confidentiality:</strong> Signature proves sender identity, encryption protects content</li>
 *   <li><strong>Secure messaging pattern:</strong> Standard in protocols like S/MIME and PGP</li>
 *   <li><strong>Order matters:</strong> Sign-then-encrypt prevents signature stripping attacks</li>
 *   <li><strong>Nested JOSE tokens:</strong> Creates JWE(JWS) structure per RFC 7516</li>
 * </ul>
 *
 * <h3>Steps:</h3>
 * <ol>
 *   <li>Resolve a pre-provisioned ML-DSA-65 signing key (post-quantum digital signature)</li>
 *   <li>Resolve a pre-provisioned ML-KEM-768 encryption key (post-quantum key encapsulation)</li>
 *   <li>Create plaintext message file</li>
 *   <li>Sign-then-encrypt: Sign with ML-DSA &rarr; Encrypt with ML-KEM (creates JWE(JWS))</li>
 *   <li>Decrypt-then-verify: Decrypt with ML-KEM &rarr; Verify with ML-DSA (reverses process)</li>
 *   <li>Validate: Original plaintext matches recovered plaintext</li>
 *   <li>Validate: Signature is cryptographically valid</li>
 * </ol>
 *
 * <h3>Key Algorithms:</h3>
 * <ul>
 *   <li><strong>ML-DSA-65:</strong> NIST FIPS 204 post-quantum signature (192-bit security)</li>
 *   <li><strong>ML-KEM-768:</strong> NIST FIPS 203 post-quantum encryption (192-bit security)</li>
 * </ul>
 *
 * <h3>API Endpoints:</h3>
 * <ul>
 *   <li>POST /api/v3/crypto/sign-encrypt (compact sign-then-encrypt operation)</li>
 *   <li>POST /api/v3/crypto/decrypt-verify (compact decrypt-then-verify operation)</li>
 * </ul>
 *
 * <p>This scenario uses the <strong>compact</strong> nested-op endpoints. For the
 * streaming (bounded-memory, large-file) counterpart with the end-of-stream
 * integrity verdict, see {@link ExampleScenario21}.</p>
 *
 * <h3>Token Structure:</h3>
 * <pre>
 * JWE Header (ML-KEM-768 encrypted symmetric key)
 *   &darr;
 * Encrypted Payload:
 *   JWS Header (ML-DSA-65 signature metadata)
 *     &darr;
 *   JWS Payload: Original plaintext
 *     &darr;
 *   JWS Signature: ML-DSA-65 signature bytes
 * </pre>
 *
 * <p><strong>Prerequisite:</strong> a {@code cli.properties} for the
 * {@code cli-reference} actor of the provisioned {@code demo-cli} playground,
 * carrying the {@code ankasecure.demo.kids} catalogue (emitted by the
 * demo-provisioning tool). The SDK is data-plane-only — key lifecycle
 * (generate/rotate/export) lives in {@code cli-admin}, not the SDK.</p>
 *
 * @author ANKATech Solutions Inc.
 * @since 3.0.0
 * @see ExampleUtil
 * @see ExamplePlaygroundKeys
 * @see AuthenticatedSdk
 */
public final class ExampleScenario17 {

    private static final Path TEMP_DIR = Path.of("temp_files");

    /** No instantiation &mdash; this class only exposes {@link #main(String[])}. */
    private ExampleScenario17() { }

    /**
     * Runs the sign-then-encrypt nested operations scenario on pre-provisioned keys.
     *
     * <p>Loads CLI properties, authenticates against ANKASecure&copy;, resolves
     * the pre-provisioned playground keys, and delegates to the scenario logic.
     * On any unrecoverable error the JVM terminates via
     * {@link ExampleUtil#fatal(String, Throwable)}.</p>
     *
     * @param args command-line arguments (ignored)
     */
    public static void main(String[] args) {
        System.out.println("===== SCENARIO 17: SIGN-THEN-ENCRYPT NESTED OPERATIONS (COMPACT) =====");
        System.out.println("Purpose: Demonstrate authenticated encryption workflow with post-quantum algorithms");
        System.out.println("Pattern: Sign-THEN-encrypt (recommended), Decrypt-THEN-verify");
        System.out.println("Keys   : pre-provisioned ML-DSA-65 (sign) + ML-KEM-768 (encrypt)");
        System.out.println();

        try {
            prepareWorkingDir();
            Properties props = loadProperties();
            AuthenticatedSdk sdk = authenticate(props);
            ExamplePlaygroundKeys playground = ExamplePlaygroundKeys.from(props, sdk);
            runScenario(sdk, playground);

            System.out.println("===== SCENARIO 17 END =====");

        } catch (Exception ex) {
            fatal("Scenario 17 failed", ex);
        }
    }

    private static void runScenario(AuthenticatedSdk sdk, ExamplePlaygroundKeys playground) throws Exception {

        // ============================================================
        // PHASE 1: Resolve pre-provisioned keys (data-plane SDK: no key creation)
        // ============================================================

        System.out.println("[Step 1/7] Resolving pre-provisioned ML-DSA-65 signing key...");
        final String signKid = playground.kidForAlgorithm("ML-DSA-65");
        System.out.println("           Signing key ID: " + signKid);
        System.out.println();

        System.out.println("[Step 2/7] Resolving pre-provisioned ML-KEM-768 encryption key...");
        final String encKid = playground.kidForAlgorithm("ML-KEM-768");
        System.out.println("           Encryption key ID: " + encKid);
        System.out.println();

        // ============================================================
        // PHASE 2: Create Plaintext
        // ============================================================

        System.out.println("[Step 3/7] Creating plaintext message...");
        final Path plainFile = TEMP_DIR.resolve("scenario17_plain.txt");
        final String originalMessage = "Scenario-17: Sign-then-encrypt nested operations with ML-DSA-65 + ML-KEM-768.";
        FileIO.writeUtf8(plainFile, originalMessage);
        System.out.println("           File: " + plainFile);
        System.out.println("           Message: \"" + originalMessage + "\"");
        System.out.println();

        // ============================================================
        // PHASE 3: Sign-Then-Encrypt (Sender Side)
        // ============================================================

        System.out.println("[Step 4/7] Performing sign-then-encrypt operation...");
        System.out.println("           Why this order? Sign-THEN-encrypt prevents signature stripping attacks");
        System.out.println("           and ensures authenticity is verified before content exposure.");
        System.out.println();

        final Path nestedFile = TEMP_DIR.resolve("scenario17_nested.jwe");

        // Sign-then-encrypt: Creates JWE(JWS(plaintext))
        // Inner layer: ML-DSA-65 signature over plaintext
        // Outer layer: ML-KEM-768 encryption of the JWS token
        SignEncryptResult signEncryptMeta = sdk.signThenEncryptFileCompact(signKid, encKid, plainFile, nestedFile);

        System.out.println("           Output file: " + nestedFile);
        printSignEncryptMeta(signEncryptMeta);
        System.out.println();

        // ============================================================
        // PHASE 4: Decrypt-Then-Verify (Receiver Side)
        // ============================================================

        System.out.println("[Step 5/7] Performing decrypt-then-verify operation...");
        System.out.println("           Reversing the process: decrypt outer layer, then verify inner signature");
        System.out.println();

        final Path recoveredFile = TEMP_DIR.resolve("scenario17_recovered.txt");

        // Decrypt-then-verify: Extracts plaintext from JWE(JWS)
        // Keys are automatically extracted from JWE and JWS headers (kid claims)
        // Outer layer: Decrypt JWE to get JWS (key auto-extracted)
        // Inner layer: Verify JWS signature to get plaintext (key auto-extracted)
        // Compact variant (whole artifact in memory). The streaming counterpart
        // (bounded memory + end-of-stream integrity verdict) is ExampleScenario21.
        DecryptVerifyResult decryptVerifyMeta = sdk.decryptThenVerifyFileCompact(nestedFile, recoveredFile);

        System.out.println("           Output file: " + recoveredFile);
        printDecryptVerifyMeta(decryptVerifyMeta);
        System.out.println();

        // ============================================================
        // PHASE 5: Validation
        // ============================================================

        System.out.println("[Step 6/7] Validating signature...");
        if (decryptVerifyMeta.isSignatureValid()) {
            System.out.println("           ✅ Signature is VALID");
            System.out.println("           Authenticity confirmed: Message was signed by " + signKid);
        } else {
            System.out.println("           ❌ Signature is INVALID");
            System.out.println("           WARNING: Message may have been tampered with!");
        }
        System.out.println();

        System.out.println("[Step 7/7] Validating plaintext recovery...");
        final String recoveredMessage = FileIO.readUtf8(recoveredFile);

        if (originalMessage.equals(recoveredMessage)) {
            System.out.println("           ✅ Plaintext matches original");
            System.out.println("           Confidentiality confirmed: Message correctly recovered");
        } else {
            System.out.println("           ❌ Plaintext does NOT match");
            System.out.println("           Expected: \"" + originalMessage + "\"");
            System.out.println("           Got:      \"" + recoveredMessage + "\"");
        }
        System.out.println();

        // ============================================================
        // FINAL STATUS
        // ============================================================

        if (decryptVerifyMeta.isSignatureValid() && originalMessage.equals(recoveredMessage)) {
            System.out.println("╔═══════════════════════════════════════════════════════════════╗");
            System.out.println("║               ✅ SCENARIO 17 SUCCESSFUL                        ║");
            System.out.println("║                                                               ║");
            System.out.println("║  Authenticated encryption complete:                           ║");
            System.out.println("║  • Authenticity: Signature verified (ML-DSA-65)               ║");
            System.out.println("║  • Confidentiality: Content decrypted (ML-KEM-768)            ║");
            System.out.println("║  • Integrity: Plaintext matches original                      ║");
            System.out.println("╚═══════════════════════════════════════════════════════════════╝");
        } else {
            System.out.println("❌ SCENARIO 17 FAILED - Validation errors detected");
        }
    }
}