#!/usr/bin/env bash
# Install-free check of the known-answer vectors: needs only bash, sha256sum (coreutils) and OpenSSL >= 1.1.1
# (secp256k1 must be available; it is in stock OpenSSL builds). No npm, no network.
# Exit 0 and last line "ALL VECTORS OK" on success; non-zero on any failure.
set -uo pipefail
cd "$(dirname "$0")"
fail=0
ok()  { echo "ok   $*"; }
bad() { echo "FAIL $*"; fail=1; }
v() { openssl dgst -sha256 -verify "$1" -signature "$2" "$3" >/dev/null 2>&1; }

echo "== kav-1: synthetic secp256k1 / sha256(JCS) vector (public test key)"
( cd kav-1 && sha256sum -c --quiet SHA256SUMS ) && ok "kav-1 SHA256SUMS" || bad "kav-1 SHA256SUMS"
[ "$(openssl dgst -sha256 -r kav-1/message.bin | cut -d' ' -f1)" = "$(cat kav-1/message.sha256)" ] && ok "sha256(message.bin) == message.sha256" || bad "message hash"
v kav-1/pub.pem kav-1/signature.der kav-1/message.bin && ok "signature verifies" || bad "signature"
v kav-1/pub.pem kav-1/signature.der kav-1/message-tampered.bin && bad "tampered message verified (must not)" || ok "tampered message rejected"

echo "== mdip-challenge-1: real MDIP create operations (challenge -> response)"
( cd mdip-challenge-1 && sha256sum -c --quiet SHA256SUMS ) && ok "mdip-challenge-1 SHA256SUMS" || bad "mdip-challenge-1 SHA256SUMS"
for k in verifier-agent:verifier-agent challenge:verifier-agent responder-agent:responder-agent response:responder-agent; do
  op=${k%%:*}; key=${k##*:}
  v "mdip-challenge-1/$key.pub.pem" "mdip-challenge-1/$op.sig.der" "mdip-challenge-1/$op.message.bin" \
    && ok "$op op signed by $key key" || bad "$op op signature"
done
v mdip-challenge-1/verifier-agent.pub.pem mdip-challenge-1/response.sig.der mdip-challenge-1/response.message.bin \
  && bad "response verified under verifier key (must not)" || ok "response NOT valid under verifier key"

[ $fail = 0 ] && echo "ALL VECTORS OK" || { echo "VECTORS FAILED"; exit 1; }