Verify signed documents against key records: ok, tampered, revoked, unknown, unsigned

# Scenario 054: Verify signed documents against key records: ok, tampered, revoked, unknown, unsigned
# A signature is checked against a list of KeyRecords. The conformance vectors carry a valid signature, a tampered document, a revoked key and an unknown key; an unsigned document gives its own reason.
# Run a hub first: python hub/cookwala_hub.py --recipes examples
import json, os
from cookwala.client import CookwalaClient, CookwalaProblem

def load(path):
    with open(path, encoding="utf-8") as f:
        return json.load(f)

def pick(obj, path):
    for part in path.replace("]", "").replace("[", ".").split("."):
        obj = obj[int(part)] if part.isdigit() else (len(obj) if part == "length" else obj.get(part))
    return obj

c = CookwalaClient(os.environ.get("COOKWALA_HUB", "http://localhost:7878"))


# Step 1: A recall signed with a key whose record is valid: ok.
valid = c.verify(pick(load("conformance/signature.json"), "1.input.document"), pick(load("conformance/signature.json"), "1.input.keys"))
assert pick(valid, "ok") == True, pick(valid, "ok")
print("ok", "ok", "=", True)
assert pick(valid, "reason") == "ok", pick(valid, "reason")
print("ok", "reason", "=", "ok")

# Step 2: The same document with one field changed: bad_signature.
tampered = c.verify(pick(load("conformance/signature.json"), "2.input.document"), pick(load("conformance/signature.json"), "2.input.keys"))
assert pick(tampered, "ok") == False, pick(tampered, "ok")
print("ok", "ok", "=", False)
assert pick(tampered, "reason") == "bad_signature", pick(tampered, "reason")
print("ok", "reason", "=", "bad_signature")

# Step 3: Signed after the key was revoked: key_revoked.
revoked = c.verify(pick(load("conformance/signature.json"), "3.input.document"), pick(load("conformance/signature.json"), "3.input.keys"))
assert pick(revoked, "ok") == False, pick(revoked, "ok")
print("ok", "ok", "=", False)
assert pick(revoked, "reason") == "key_revoked", pick(revoked, "reason")
print("ok", "reason", "=", "key_revoked")

# Step 4: A key id that no record matches: unknown_key.
unknown = c.verify(pick(load("conformance/signature.json"), "4.input.document"), pick(load("conformance/signature.json"), "4.input.keys"))
assert pick(unknown, "ok") == False, pick(unknown, "ok")
print("ok", "ok", "=", False)
assert pick(unknown, "reason") == "unknown_key", pick(unknown, "reason")
print("ok", "reason", "=", "unknown_key")

# Step 5: The example incident report carries no signature at all: unsigned.
unsigned = c.verify(load("examples/core/incident.json"), [])
assert pick(unsigned, "ok") == False, pick(unsigned, "ok")
print("ok", "ok", "=", False)
assert pick(unsigned, "reason") == "unsigned", pick(unsigned, "reason")
print("ok", "reason", "=", "unsigned")

print("scenario complete")