"""Schism differential JWT verifier.

Submits each corpus case to every running target. Flags any disagreement

in the `valid` field. Errors are bucketed (not literal-string compared) so

different wording across libs doesn't cause false positives.

"""

import argparse

import asyncio

import json

import sys

import time

from pathlib import Path

import aiohttp

TARGETS = {

    "nodejwt": "http://localhost:7001/verify",

    "pyjwt":   "http://localhost:7002/verify",

    "pyjose":  "http://localhost:7003/verify",

    "panva":   "http://localhost:7004/verify",

    "gojwt":   "http://localhost:7005/verify",

}

async def submit_one(session, name, url, payload):

    try:

        async with session.post(url, json=payload, timeout=10) as r:

            return name, await r.json()

    except Exception as e:

        return name, {"valid": None, "error": f"transport: {e}", "lib": name}

async def submit_all(session, payload, target_filter=None):

    tasks = [

        submit_one(session, n, u, payload)

        for n, u in TARGETS.items()

        if not target_filter or n in target_filter

    ]

    results = await asyncio.gather(*tasks)

    return dict(results)

def disagreement(results):

    verdicts = {n: r.get("valid") for n, r in results.items()}

    distinct = set(v for v in verdicts.values() if v is not None)

    return len(distinct) > 1

async def health_check(session):

    """Probe each target. None => unreachable."""

    healthy = []

    for n, url in TARGETS.items():

        try:

            async with session.post(url, json={"token": "", "key": "", "algs": []}, timeout=3) as r:

                if r.status == 200:

                    healthy.append(n)

        except Exception:

            pass

    return healthy

async def run(corpus_path, output_path, only=None):

    cases = json.loads(Path(corpus_path).read_text())

    out_f = open(output_path, "w") if output_path else None

    flagged = 0

    async with aiohttp.ClientSession() as session:

        healthy = await health_check(session)

        sys.stderr.write(f"[schism] {len(healthy)}/{len(TARGETS)} targets up: {healthy}\n")

        if not healthy:

            sys.stderr.write("[schism] no targets reachable. did you `docker compose up -d`?\n")

            return 2

        for case in cases:

            if only and case["id"] != only:

                continue

            payload = {

                "token": case["token"],

                "key":   case["key"],

                "algs":  case["algs"],

            }

            results = await submit_all(session, payload, target_filter=set(healthy))

            disagree = disagreement(results)

            sev = case.get("severity", "?")

            expected = case.get("expected_unanimous", "reject")

            verdicts = {n: r.get("valid") for n, r in results.items()}

            row = {

                "id": case["id"],

                "class": case.get("class"),

                "severity": sev,

                "expected": expected,

                "verdicts": verdicts,

                "errors":   {n: r.get("error") for n, r in results.items()},

                "claims":   {n: r.get("claims") for n, r in results.items()},

                "disagree": disagree,

                "ts": time.time(),

            }

            if out_f:

                out_f.write(json.dumps(row) + "\n")

            if disagree:

                flagged += 1

                acceptors = [n for n, v in verdicts.items() if v is True]

                rejectors = [n for n, v in verdicts.items() if v is False]

                tag = "BYPASS" if (expected == "reject" and acceptors)\

                      else "DOS"  if (expected == "accept" and rejectors)\

                      else "SPLIT"

                sys.stderr.write(

                    f"[{tag:^6}] {case['id']:36s} sev={sev:12s} "

                    f"accept={acceptors}  reject={rejectors}\n"

                )

            else:

                v = next(iter(set(verdicts.values())), None)

                tag = "accept" if v is True else "reject" if v is False else "?"

                match = " " if tag == expected else "!"

                sys.stderr.write(

                    f"[ ok ]{match}{case['id']:36s} all-{tag:6s} expected={expected}\n"

                )

    if out_f:

        out_f.close()

    sys.stderr.write(f"[schism] done. flagged {flagged}/{len(cases)} cases\n")

    return 0 if flagged == 0 else 1

def main():

    ap = argparse.ArgumentParser()

    ap.add_argument("--corpus", default="corpus/seed.json")

    ap.add_argument("--out", default=None,

                    help="findings/<ts>.jsonl (default: auto)")

    ap.add_argument("--only", default=None, help="run a single case by id")

    args = ap.parse_args()

    if args.out is None:

        args.out = f"findings/{int(time.time())}.jsonl"

    sys.exit(asyncio.run(run(args.corpus, args.out, args.only)))

if __name__ == "__main__":

    main()