{% extends "pypi_profile/base.html" %}
{% import "pypi_ds/components/layout.html" as layout %}
{% import "pypi_ds/components/feedback.html" as feedback %}
{% import "pypi_ds/components/navigation.html" as navigation %}
{% import "pypi_profile/components.html" as pc %}

{% block profile_title %}Verification{% endblock %}

{% block content %}
  {{ pc.profile_header(profile) }}

  {% call layout.horizontal_section("horizontal-section--grey horizontal-section--thin") %}
    <div class="package-summary">
      <p class="package-summary__text">Verification and proof-of-control details</p>
    </div>
  {% endcall %}

  {% call layout.horizontal_section() %}
    <div class="project-layout">
      <aside class="project-layout__navigation">
        {{ navigation.vertical_tabs([
          {"id": "overview", "label": "Overview", "href": _base ~ "/"},
          {"id": "verification", "label": "Verification", "href": _base ~ "/verification"},
          {"id": "succession", "label": "Succession", "href": _base ~ "/succession"}
        ], active_id="verification", aria_label="Profile navigation") }}
      </aside>
      <div class="project-layout__content">
        {% call layout.card("Publication proof", "project-panel") %}
          {{ feedback.notification(
            "This profile was published to PyPI by the account holder. Publication is the root proof of control.",
            tone="success", title="PyPI-published"
          ) }}
          {% if profile.identity.pypi_username %}
            <p>PyPI account: <strong>{{ profile.identity.pypi_username }}</strong></p>
          {% endif %}
        {% endcall %}

        {% call layout.card("Public key", "project-panel") %}
          {% if profile.verification.public_key %}
            {{ feedback.status_badge("Public key present", tone="good") }}
            <p>Signature backend: {{ profile.verification.preferred_signature_backend }}</p>
            <details>
              <summary>View public key</summary>
              <pre><code>{{ profile.verification.public_key }}</code></pre>
            </details>
          {% else %}
            {{ feedback.badge("No public key provided") }}
            <p class="sidebar-copy">Add a public key to enable signed proof-of-control claims.</p>
          {% endif %}
        {% endcall %}

        {% call layout.card("External profile claims", "project-panel") %}
          {% if static_mode %}
            {{ feedback.notification(
              "This is a static build. Verification status is derived from stored_proof values baked into the TOML. Live checks run in the browser and update the table below.",
              tone="info", title="Static build"
            ) }}
          {% else %}
            {{ feedback.notification(
              "Live server: verification is performed server-side by fetching each URL. Diagnostics are shown below.",
              tone="info", title="Live verification"
            ) }}
          {% endif %}
          {% if claim_results %}
            <table class="table table--light">
              <thead>
                <tr>
                  <th>Profile</th>
                  <th>URL</th>
                  <th>{% if static_mode %}Status (stored){% else %}Status{% endif %}</th>
                  {% if static_mode %}<th>Live check</th>{% endif %}
                  {% if not static_mode %}<th>Diagnostics</th>{% endif %}
                </tr>
              </thead>
              <tbody>
                {% for item in claim_results %}
                  <tr data-profile-url="{{ item.url }}">
                    <td>{{ item.label }}</td>
                    <td><a href="{{ item.url }}">{{ item.url }}</a></td>
                    <td>{{ pc.claim_badge(item.status) }}</td>
                    {% if static_mode %}<td class="live-status" data-url="{{ item.url }}"><span class="badge">—</span></td>{% endif %}
                    {% if not static_mode %}
                      <td>
                        {% if item.detail %}
                          <details>
                            <summary style="cursor:pointer;font-size:0.85rem;">{% if item.status == 'verified' %}✓ steps{% else %}why?{% endif %}</summary>
                            <ol style="margin:0.5rem 0 0 1rem;padding:0;font-size:0.8rem;font-family:monospace;white-space:pre-wrap;">
                              {% for step in item.detail %}<li>{{ step }}</li>{% endfor %}
                            </ol>
                          </details>
                        {% endif %}
                      </td>
                    {% endif %}
                  </tr>
                {% endfor %}
              </tbody>
            </table>
          {% elif profile.profiles %}
            <table class="table table--light">
              <thead>
                <tr>
                  <th>Profile</th>
                  <th>URL</th>
                  <th>Status</th>
                </tr>
              </thead>
              <tbody>
                {% for link in profile.profiles %}
                  <tr>
                    <td>{{ link.label }}</td>
                    <td><a href="{{ link.url }}"{% if link.rel_me %} rel="me"{% endif %}>{{ link.url }}</a></td>
                    <td>{{ pc.claim_badge(link.verification) }}</td>
                  </tr>
                {% endfor %}
              </tbody>
            </table>
          {% else %}
            <p>No external profiles listed.</p>
          {% endif %}
        {% endcall %}

        {% if proofs %}
          {% call layout.card("Add proof-of-control", "project-panel") %}
            {% for item in proofs %}
              <div style="margin-bottom: 1.5rem;">
                <p style="margin-bottom: 0.25rem;">
                  <strong>{{ item.label }}</strong>
                  — <a href="{{ item.url }}">{{ item.url }}</a>
                </p>
                {% if item.proof %}
                  <p class="sidebar-copy" style="margin-bottom: 0.25rem;">
                    Paste this into your {{ item.label }} profile (README, bio, or any public page at that URL):
                  </p>
                  <pre style="white-space: pre-wrap; word-break: break-all; background: #f5f5f5; padding: 0.75rem; border-radius: 4px; font-size: 0.8rem;"><code>{{ item.proof }}</code></pre>
                {% elif item.error == "no-key" %}
                  {{ feedback.notification(
                    "No secret key found. Run <code>pypi-profile keygen</code> to generate one, then reload this page.",
                    tone="warning", title="Key required"
                  ) }}
                {% else %}
                  {{ feedback.notification(item.error, tone="bad", title="Could not generate proof") }}
                {% endif %}
              </div>
            {% endfor %}
          {% endcall %}
        {% endif %}
      </div>
      <aside class="project-layout__sidebar">
        {% call layout.sidebar_section("What verification means") %}
          <p class="sidebar-copy">
            <strong>PyPI-published:</strong> The account holder published this package.
          </p>
          <p class="sidebar-copy">
            <strong>Self-asserted:</strong> Claimed by the profile package but not independently verified.
          </p>
          <p class="sidebar-copy">
            <strong>Verified:</strong> Signature confirmed on the external site.
          </p>
          <p class="sidebar-copy">
            <strong>Live check:</strong> For GitHub profiles the browser fetches the README and cryptographically verifies the proof token. Results appear in the "Live check" column. Open the browser console (F12) for detailed diagnostics.
          </p>
        {% endcall %}
      </aside>
    </div>
  {% endcall %}

<script type="module">
// ---------------------------------------------------------------------------
// pypi-profile · verification diagnostics
//
// Loads api/verification.json (same-origin, works on static sites), logs a
// structured summary, then attempts live browser-side cryptographic
// verification for any GitHub profile URLs found.
//
// GitHub-specific live check:
//   • Fetches raw.githubusercontent.com/<user>/<user>/HEAD/README.md
//     (CORS-open; the profile README where the proof string is pasted).
//   • Extracts the pypi-profile-proof token, decodes the claim JSON.
//   • Verifies the Ed25519 signature using:
//       - Blake2b-512 (blakejs via esm.sh) for prehash  ← minisign prehash mode
//       - crypto.subtle Ed25519 (Web Crypto API)
//   • Public key: strip the 10-byte minisign header from the TOML base64 value
//     to get the raw 32-byte Ed25519 key.
//   • Signature: strip the 10-byte minisign header from the claim's sig field
//     to get the raw 64-byte Ed25519 signature.
// ---------------------------------------------------------------------------

import { blake2b } from 'https://esm.sh/blakejs@1.2.1/blake2b';

const base   = {{ (_base ~ '') | tojson }};
const apiUrl = (base || '') + '/api/verification.json';

const STATUS_EMOJI = {verified:'✅', self_asserted:'🔵', unverified:'❓', invalid:'❌', expired:'⚠️'};
function emoji(s) { return STATUS_EMOJI[s] || '❓'; }

// ── helpers ────────────────────────────────────────────────────────────────

function b64decode(str) {
  // Standard base64 → Uint8Array
  return Uint8Array.from(atob(str), c => c.charCodeAt(0));
}

function b64urlDecode(str) {
  // Base64url (no padding) → Uint8Array
  const padded = str.replace(/-/g, '+').replace(/_/g, '/')
                    .padEnd(str.length + (4 - str.length % 4) % 4, '=');
  return b64decode(padded);
}

function isCompactClaim(claim) {
  return 'p' in claim && 's' in claim;
}

function canonicalClaimBytes(claim) {
  // Matches Python claim_to_bytes(): JSON sorted keys, no signature field (full='signature', compact='g').
  const copy = Object.fromEntries(
    Object.keys(claim).filter(k => k !== 'signature' && k !== 'g').sort()
      .map(k => [k, claim[k]])
  );
  return new TextEncoder().encode(JSON.stringify(copy));
}

function isExpired(claim) {
  if (isCompactClaim(claim)) {
    if (!claim.e) return false;
    return Date.now() / 1000 > claim.e;
  }
  if (!claim.expires_at) return false;
  return new Date(claim.expires_at + 'Z') < new Date();
}

function claimSubject(claim) {
  return isCompactClaim(claim) ? claim.s : claim.subject;
}

// Extract github username from https://github.com/<user> URLs
function githubUser(url) {
  const m = url.match(/^https?:\/\/github\.com\/([A-Za-z0-9_.-]+)\/?$/);
  return m ? m[1] : null;
}

// Raw README URL — try HEAD branch alias so it works for main and master.
function githubReadmeUrl(user) {
  return `https://raw.githubusercontent.com/${user}/${user}/HEAD/README.md`;
}

// Find all pypi-profile-proof tokens in text.
const PROOF_RE = /pypi-profile-proof:\s*([A-Za-z0-9_\-]+=*)/gi;
function findProofTokens(text) {
  const tokens = [];
  let m;
  while ((m = PROOF_RE.exec(text)) !== null) tokens.push(m[0]);
  PROOF_RE.lastIndex = 0;
  return tokens;
}

// ── crypto ─────────────────────────────────────────────────────────────────

async function verifySignature(publicKeyB64, claim) {
  // publicKeyB64: minisign base64 — 42 bytes: 2-byte algo + 8-byte key_id + 32-byte ed25519 pk
  const pkFull = b64decode(publicKeyB64);  // 42 bytes
  if (pkFull.length !== 42) throw new Error(`Unexpected public key length: ${pkFull.length} (expected 42)`);
  const rawPk = pkFull.slice(10);  // 32 bytes

  let rawSig;
  if (isCompactClaim(claim)) {
    // Compact: claim.g is base64url of the raw 64-byte Ed25519 sig (no header).
    rawSig = b64urlDecode(claim.g);
    if (rawSig.length !== 64) throw new Error(`Unexpected compact sig length: ${rawSig.length} (expected 64)`);
  } else {
    // Full: claim.signature is standard base64 of 74-byte minisign binary.
    const sigFull = b64decode(claim.signature);
    if (sigFull.length !== 74) throw new Error(`Unexpected signature length: ${sigFull.length} (expected 74)`);
    const algoBytes = String.fromCharCode(sigFull[0], sigFull[1]);
    if (algoBytes !== 'ED') throw new Error(`Unexpected sig algorithm "${algoBytes}" — expected "ED" (prehash).`);
    rawSig = sigFull.slice(10);  // 64 bytes
  }

  // Prehash: blake2b-512(canonical_claim_json)
  const msgBytes = canonicalClaimBytes(claim);
  const msgHash  = blake2b(msgBytes, null, 64);  // 64-byte = 512-bit output

  const cryptoKey = await crypto.subtle.importKey(
    'raw', rawPk, { name: 'Ed25519' }, false, ['verify']
  );

  return crypto.subtle.verify({ name: 'Ed25519' }, cryptoKey, rawSig, msgHash);
}

// ── DOM helpers ────────────────────────────────────────────────────────────

function setLiveStatus(url, html) {
  const cell = document.querySelector(`.live-status[data-url="${CSS.escape(url)}"]`);
  if (cell) cell.innerHTML = html;
}

// ── per-URL live GitHub check ───────────────────────────────────────────────

async function checkGithub(item, publicKeyB64) {
  const user = githubUser(item.url);
  if (!user) return;

  const readmeUrl = githubReadmeUrl(user);
  setLiveStatus(item.url, '<span class="badge">checking…</span>');
  console.group(`  🔍 Live GitHub check for ${item.label} (${item.url})`);
  console.info('Fetching', readmeUrl);

  let text;
  try {
    const r = await fetch(readmeUrl);
    if (!r.ok) {
      if (r.status === 404) {
        const msg = `README not found — create a profile README repo at github.com/new named "${user}"`;
        console.warn(msg);
        setLiveStatus(item.url, `<span class="badge badge--warning" title="${msg}">❓ no README</span>`);
      } else {
        console.warn(`HTTP ${r.status} fetching README`);
        setLiveStatus(item.url, `<span class="badge badge--warning">HTTP ${r.status}</span>`);
      }
      console.groupEnd();
      return;
    }
    text = await r.text();
  } catch (err) {
    console.error('Fetch failed:', err.message);
    setLiveStatus(item.url, `<span class="badge badge--bad" title="${err.message}">❌ fetch error</span>`);
    console.groupEnd();
    return;
  }

  const tokens = findProofTokens(text);
  console.info(`Found ${tokens.length} proof token(s) in README`);

  if (tokens.length === 0) {
    console.warn('No pypi-profile-proof token found in README.');
    console.warn('Paste the proof string from "Add proof-of-control" section into your profile README.');
    setLiveStatus(item.url, '<span class="badge badge--warning">❓ no proof token</span>');
    console.groupEnd();
    return;
  }

  let matched = false;
  for (const tokenStr of tokens) {
    const b64part = tokenStr.replace(/^pypi-profile-proof:\s*/i, '');
    let claim;
    try {
      claim = JSON.parse(new TextDecoder().decode(b64urlDecode(b64part)));
    } catch (e) {
      console.warn('Could not decode token:', tokenStr.slice(0, 80), '—', e.message);
      continue;
    }

    console.debug('Decoded claim:', claim);

    if (claimSubject(claim) !== item.url) {
      console.debug('Subject mismatch — skipping (subject:', claimSubject(claim), ')');
      continue;
    }

    matched = true;

    if (isExpired(claim)) {
      console.warn('⚠️  Claim is EXPIRED (expires_at:', claim.expires_at, ')');
      console.warn('    Re-run: pypi-profile update-proofs <source>');
      setLiveStatus(item.url, `<span class="badge badge--warning" title="expired ${claim.expires_at}">⚠️ expired</span>`);
      break;
    }

    if (!publicKeyB64) {
      console.warn('❓  Token found but no public_key in TOML — cannot verify signature.');
      console.warn('    Run: pypi-profile keygen  then add the public key to [verification].');
      setLiveStatus(item.url, '<span class="badge">❓ no key</span>');
      break;
    }

    console.info('Verifying Ed25519 signature via Web Crypto + Blake2b-512…');
    try {
      const valid = await verifySignature(publicKeyB64, claim);
      if (valid) {
        console.info('✅  Signature VALID — claim is cryptographically verified!');
        console.info('    profile_package:', claim.profile_package);
        console.info('    pypi_username  :', claim.pypi_username);
        console.info('    issued_at      :', claim.issued_at);
        console.info('    expires_at     :', claim.expires_at);
        setLiveStatus(item.url, `<span class="badge badge--good" title="expires ${claim.expires_at}">✅ verified</span>`);
      } else {
        console.error('❌  Signature INVALID — proof token found but signature does not verify.');
        console.error('    Check that public_key in [verification] matches the key used to sign.');
        setLiveStatus(item.url, '<span class="badge badge--bad" title="Signature does not verify — check public_key in TOML">❌ invalid sig</span>');
      }
    } catch (err) {
      console.error('❌  Verification error:', err.message);
      if (err.message.includes('Ed25519')) {
        console.warn('    Your browser may not support Ed25519 in Web Crypto. Try Chrome 137+ or Firefox 129+.');
      }
      setLiveStatus(item.url, `<span class="badge badge--bad" title="${err.message}">❌ error</span>`);
    }
    break;
  }

  if (!matched) {
    console.warn('No token with subject matching', item.url, 'found.');
    console.warn('Expected claim subject (full: claim.subject, compact: claim.s) to equal:', item.url);
    setLiveStatus(item.url, '<span class="badge badge--warning" title="No token found with matching subject URL">❓ subject mismatch</span>');
  }

  console.groupEnd();
}

// ── main ───────────────────────────────────────────────────────────────────

async function main() {
  console.group('pypi-profile · verification diagnostics');

  let data;
  try {
    const r = await fetch(apiUrl);
    if (!r.ok) throw new Error(`HTTP ${r.status} from ${apiUrl}`);
    data = await r.json();
  } catch (err) {
    console.error('Failed to load verification data:', err.message, '—', apiUrl);
    console.groupEnd();
    return;
  }

  const results = data.claim_results || [];
  console.info('Public key present:', !!data.public_key);
  console.info('Signature backend :', data.preferred_signature_backend || '(not set)');
  console.info('Static build      :', !!data.static_mode);
  console.info('Claims found      :', results.length);

  if (results.length === 0) {
    console.warn('No claim results — check [[profiles]] entries and [verification] public_key in your TOML.');
  }

  for (const item of results) {
    const label = emoji(item.status) + ' ' + item.label + ' — ' + item.status.toUpperCase();
    if (item.status === 'verified' || item.status === 'self_asserted') {
      console.info(label, item.url);
    } else {
      console.warn(label, item.url);
    }

    if (item.status === 'unverified' && data.static_mode && !item.has_stored_proof) {
      console.warn('    → No stored_proof in TOML. Run: pypi-profile update-proofs <source>');
    }
    if (item.status === 'invalid') {
      console.error('    → Signature verification FAILED. Check public_key matches signing key.');
    }
    if (item.status === 'expired') {
      console.warn('    → Claim expired. Re-run: pypi-profile update-proofs <source>');
    }
    if (data.static_mode && item.has_stored_proof) {
      console.debug('    stored_proof present in TOML for', item.url);
    }

    // Live GitHub check (CORS-open via raw.githubusercontent.com)
    if (githubUser(item.url)) {
      await checkGithub(item, data.public_key || '');
    }
  }

  if (!data.public_key) {
    console.warn('No public_key in [verification]. Run: pypi-profile keygen');
  }

  console.groupEnd();
}

main();
</script>
{% endblock %}