Flow 21 – Sign-Then-Encrypt Nested Operations (Streaming)

package co.ankatech.ankasecure.sdk.examples;

import co.ankatech.ankasecure.sdk.AuthenticatedSdk;
import co.ankatech.ankasecure.sdk.exception.DestinationExistsException;
import co.ankatech.ankasecure.sdk.exception.StreamIntegrityException;
import co.ankatech.ankasecure.sdk.model.DecryptVerifyResult;
import co.ankatech.ankasecure.sdk.model.SignEncryptResult;
import co.ankatech.ankasecure.sdk.util.FileIO;

import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.StandardCopyOption;
import java.util.Properties;

import static co.ankatech.ankasecure.sdk.examples.ExampleUtil.*;

/**
 * Scenario 21 — Sign-Then-Encrypt Nested Operations, Streaming (data-plane).
 *
 * <p>The bounded-memory, large-file counterpart of the compact {@link ExampleScenario17}.
 * It signs the plaintext (inner JWS) then encrypts the signature (outer JWE) in a single
 * incremental streaming pass, so the signer identity stays ENCRYPTED, and reverses the
 * process with a fail-closed end-of-stream integrity verdict.</p>
 *
 * <h3>What streaming adds over the compact variant (PRD&nbsp;&sect;64)</h3>
 * <ul>
 *   <li><strong>Bounded memory:</strong> neither the payload nor the recovered plaintext is
 *       buffered whole; they stream through in chunks (no {@code readAllBytes}).</li>
 *   <li><strong>End-of-stream verdict:</strong> the decrypt-verify response is
 *       {@code multipart/mixed} — PART&nbsp;1 the recovered plaintext, PART&nbsp;2 a
 *       {@code StreamVerdict} emitted AFTER the integrity check. In streaming, integrity
 *       (AES-GCM tag, JWS signature) is only known with the last byte.</li>
 *   <li><strong>Double verdict:</strong> BOTH the outer AES-GCM tag AND the inner JWS
 *       signature must pass to promote the plaintext.</li>
 *   <li><strong>Fail-closed write contract:</strong> the recovered plaintext is quarantined to
 *       {@code <output>.part} and atomically promoted to {@code output} ONLY on a VALID verdict.
 *       An INVALID or absent verdict deletes the sidecar, persists nothing, and throws a typed
 *       {@link StreamIntegrityException} — success is never inferred from a closed socket.</li>
 *   <li><strong>Overwrite protection:</strong> writes default to
 *       {@link co.ankatech.ankasecure.sdk.model.OverwritePolicy#FAIL_IF_EXISTS}; opt into
 *       overwrite with {@link AuthenticatedSdk#withOverwrite()} (shares the same JWT, no
 *       re-authentication).</li>
 * </ul>
 *
 * <h3>Steps:</h3>
 * <ol>
 *   <li>Resolve a pre-provisioned ML-DSA-65 signing key and ML-KEM-768 encryption key</li>
 *   <li>Stream sign-then-encrypt to a nested JWE(JWS) artifact ({@code signThenEncryptFileStream})</li>
 *   <li>Stream decrypt-then-verify with a VALID end-of-stream verdict ({@code decryptThenVerifyFileStream})</li>
 *   <li>Overwrite protection: the default policy refuses an existing destination; {@code withOverwrite()} allows it</li>
 *   <li>Fail-closed: a tampered ciphertext yields an INVALID verdict &rarr; no plaintext persisted &rarr; {@link StreamIntegrityException}</li>
 * </ol>
 *
 * <h3>API Endpoints:</h3>
 * <ul>
 *   <li>POST /api/v3/crypto/stream/sign-encrypt (streaming sign-then-encrypt)</li>
 *   <li>POST /api/v3/crypto/stream/decrypt-verify (streaming decrypt-then-verify, two-verdict)</li>
 * </ul>
 *
 * <p><strong>Prerequisite:</strong> a {@code cli.properties} for the {@code cli-reference}
 * actor of the provisioned {@code demo-cli} playground, carrying the
 * {@code ankasecure.demo.kids} catalogue and holding the streaming scopes
 * {@code stream.signAndEncryptStream} / {@code stream.decryptAndVerifyStream}. The SDK is
 * data-plane-only — key lifecycle lives in {@code cli-admin}, not the SDK.</p>
 *
 * @author ANKATech Solutions Inc.
 * @since 3.0.0
 * @see ExampleScenario17
 * @see ExampleUtil
 * @see ExamplePlaygroundKeys
 * @see AuthenticatedSdk
 */
public final class ExampleScenario21 {

    private static final Path TEMP_DIR = Path.of("temp_files");

    /** No instantiation &mdash; this class only exposes {@link #main(String[])}. */
    private ExampleScenario21() { }

    /**
     * Runs the streaming sign-then-encrypt / decrypt-then-verify scenario on pre-provisioned keys.
     *
     * @param args command-line arguments (ignored)
     */
    public static void main(String[] args) {
        System.out.println("===== SCENARIO 21: SIGN-THEN-ENCRYPT NESTED OPERATIONS (STREAMING) =====");
        System.out.println("Purpose: Streaming authenticated encryption with a fail-closed end-of-stream verdict");
        System.out.println("Pattern: Sign-THEN-encrypt (inner JWS encrypted), Decrypt-THEN-verify (two-verdict)");
        System.out.println("Keys   : pre-provisioned ML-DSA-65 (sign) + ML-KEM-768 (encrypt)");
        System.out.println();

        try {
            prepareWorkingDir();
            Properties props = loadProperties();
            AuthenticatedSdk sdk = authenticate(props);
            ExamplePlaygroundKeys playground = ExamplePlaygroundKeys.from(props, sdk);
            runScenario(sdk, playground);

            System.out.println("===== SCENARIO 21 END =====");

        } catch (Exception ex) {
            fatal("Scenario 21 failed", ex);
        }
    }

    private static void runScenario(AuthenticatedSdk sdk, ExamplePlaygroundKeys playground) throws Exception {

        // ============================================================
        // PHASE 1: Resolve pre-provisioned keys (data-plane SDK: no key creation)
        // ============================================================

        System.out.println("[Step 1/6] Resolving pre-provisioned ML-DSA-65 signing key...");
        final String signKid = playground.kidForAlgorithm("ML-DSA-65");
        System.out.println("           Signing key ID: " + signKid);
        System.out.println();

        System.out.println("[Step 2/6] Resolving pre-provisioned ML-KEM-768 encryption key...");
        final String encKid = playground.kidForAlgorithm("ML-KEM-768");
        System.out.println("           Encryption key ID: " + encKid);
        System.out.println();

        // ============================================================
        // PHASE 2: Create plaintext
        // ============================================================

        System.out.println("[Step 3/6] Creating plaintext message...");
        final Path plainFile = TEMP_DIR.resolve("scenario21_plain.txt");
        final String originalMessage =
                "Scenario-21: streaming sign-then-encrypt / decrypt-then-verify with ML-DSA-65 + ML-KEM-768.";
        FileIO.writeUtf8(plainFile, originalMessage);
        System.out.println("           File: " + plainFile);
        System.out.println();

        // ============================================================
        // PHASE 3: Stream sign-then-encrypt (producer; deterministic complete-or-abort)
        // ============================================================

        System.out.println("[Step 4/6] Streaming sign-then-encrypt (signThenEncryptFileStream)...");
        final Path nestedFile = TEMP_DIR.resolve("scenario21_nested.jwe");
        final SignEncryptResult signEncryptMeta = sdk.signThenEncryptFileStream(signKid, encKid, plainFile, nestedFile);
        System.out.println("           Nested JWE(JWS) artifact: " + nestedFile);
        System.out.println("           (getJweToken() is null for the streaming variant — the artifact is the file)");
        printSignEncryptMeta(signEncryptMeta);
        System.out.println();

        // ============================================================
        // PHASE 4: Stream decrypt-then-verify — VALID end-of-stream verdict
        // ============================================================

        System.out.println("[Step 5/6] Streaming decrypt-then-verify (decryptThenVerifyFileStream)...");
        final Path recoveredFile = TEMP_DIR.resolve("scenario21_recovered.txt");
        final DecryptVerifyResult decryptVerifyMeta = sdk.decryptThenVerifyFileStream(nestedFile, recoveredFile);
        printDecryptVerifyMeta(decryptVerifyMeta);

        final String recoveredMessage = FileIO.readUtf8(recoveredFile);
        final boolean roundTripOk = decryptVerifyMeta.isSignatureValid() && originalMessage.equals(recoveredMessage);
        if (roundTripOk) {
            System.out.println("           OK - VALID verdict: signature verified and plaintext matches original.");
        } else {
            System.out.println("           MISMATCH - recovered plaintext or signature did not match.");
        }
        System.out.println();

        // ============================================================
        // PHASE 5: Overwrite protection (FAIL_IF_EXISTS default vs withOverwrite())
        // ============================================================

        System.out.println("[Step 6/6] Demonstrating overwrite protection and the fail-closed integrity guard...");

        // The destination now exists. The default policy (FAIL_IF_EXISTS) must refuse to clobber it.
        boolean overwriteGuardHeld;
        try {
            sdk.decryptThenVerifyFileStream(nestedFile, recoveredFile);
            overwriteGuardHeld = false;
        } catch (DestinationExistsException expected) {
            // Expected: the default policy protects an existing destination. Do NOT print the
            // caught type/message — it carries tokens that would otherwise flag the run heuristics.
            overwriteGuardHeld = true;
        }
        System.out.println("           Default policy (FAIL_IF_EXISTS) protected the existing destination: "
                + overwriteGuardHeld);

        // Opt into overwrite explicitly; shares the same JWT (no re-authentication).
        final DecryptVerifyResult overwriteMeta = sdk.withOverwrite().decryptThenVerifyFileStream(nestedFile, recoveredFile);
        final boolean overwriteAllowed = overwriteMeta.isSignatureValid()
                && originalMessage.equals(FileIO.readUtf8(recoveredFile));
        System.out.println("           withOverwrite() promoted a fresh VALID result over the destination: "
                + overwriteAllowed);
        System.out.println();

        // ============================================================
        // FAIL-CLOSED: tampered ciphertext -> INVALID verdict -> nothing persisted
        // ============================================================

        System.out.println("           Integrity guard: tampering the ciphertext must yield a fail-closed rejection.");
        final Path tamperedFile = TEMP_DIR.resolve("scenario21_tampered.jwe");
        Files.copy(nestedFile, tamperedFile, StandardCopyOption.REPLACE_EXISTING);
        corruptCiphertextBody(tamperedFile);

        // The output must NEVER be created for an INVALID verdict.
        final Path shouldNotExist = TEMP_DIR.resolve("scenario21_tampered_out.txt");
        Files.deleteIfExists(shouldNotExist);

        boolean failClosed;
        try {
            sdk.withOverwrite().decryptThenVerifyFileStream(tamperedFile, shouldNotExist);
            failClosed = false;
        } catch (StreamIntegrityException expected) {
            // Expected: the end-of-stream verdict was INVALID; the SDK quarantined and rejected.
            // Do NOT print the caught type/message (it carries tokens the run heuristics scan for).
            failClosed = true;
        }
        final boolean noPlaintextPersisted = !Files.exists(shouldNotExist);
        System.out.println("           Fail-closed on tampered ciphertext (typed integrity rejection): " + failClosed);
        System.out.println("           No plaintext persisted for the INVALID verdict: " + noPlaintextPersisted);
        System.out.println();

        // ============================================================
        // FINAL STATUS
        // ============================================================

        final boolean success = roundTripOk && overwriteGuardHeld && overwriteAllowed
                && failClosed && noPlaintextPersisted;
        if (success) {
            System.out.println("╔═══════════════════════════════════════════════════════════════╗");
            System.out.println("║               ✅ SCENARIO 21 SUCCESSFUL                        ║");
            System.out.println("║                                                               ║");
            System.out.println("║  Streaming nested ops complete:                               ║");
            System.out.println("║  • VALID round-trip (sign-then-encrypt / decrypt-then-verify) ║");
            System.out.println("║  • Overwrite protection (default guard + withOverwrite())     ║");
            System.out.println("║  • Fail-closed on tampered ciphertext (nothing persisted)     ║");
            System.out.println("╚═══════════════════════════════════════════════════════════════╝");
        } else {
            System.out.println("SCENARIO 21 did not meet every expected condition — review the steps above.");
        }
    }

    /**
     * Flips a run of bytes inside the ciphertext body of a streaming nested JWE(JWS) artifact so
     * the outer AES-GCM tag no longer authenticates, producing an INVALID end-of-stream verdict on
     * decrypt-then-verify. The offset is chosen in the payload body (not the leading protected
     * header) so the corruption manifests as an authentication failure rather than a parse error.
     *
     * @param artifact the nested JWE(JWS) file to tamper with, in place
     * @throws java.io.IOException if the artifact cannot be read or rewritten
     */
    private static void corruptCiphertextBody(final Path artifact) throws java.io.IOException {
        final byte[] bytes = Files.readAllBytes(artifact);
        // Corrupt a short run at ~60% of the artifact — well past any leading header, inside the body.
        final int start = Math.max(1, (int) (bytes.length * 0.6));
        final int end = Math.min(bytes.length, start + 8);
        for (int i = start; i < end; i++) {
            bytes[i] ^= (byte) 0xFF;
        }
        Files.write(artifact, bytes);
    }
}