#!/usr/bin/env python
#
# tyr/tools/eval_tyr_identity.py - MCP Tool for verifying SPIFFE identities
#
import subprocess

def eval_tyr_identity(p: dict) -> dict:
    """Verifies the validity and properties of a SPIFFE SVID by querying the SPIRE server."""
    spiffe_id = p.get("spiffe_id")
    if not spiffe_id:
        raise ValueError("Missing required parameter: 'spiffe_id'")

    if not spiffe_id.startswith("spiffe://vauco.no/"):
        return {"status": "FAIL", "reason": "Invalid SPIFFE ID format for trust domain 'vauco.no'."}

    try:
        # This assumes the spire-server binary is in the path or at this location
        cmd = ["./spire-1.15.3/bin/spire-server", "entry", "show", "-spiffeID", spiffe_id]
        result = subprocess.run(cmd, capture_output=True, text=True, check=True, timeout=10)
        
        if "Found 1 entry" in result.stdout:
             # A more robust check would parse the TTL and other details
             return {"status": "PASS", "spiffe_id": spiffe_id, "message": "Entry found and is active."}
        else:
             return {"status": "FAIL", "spiffe_id": spiffe_id, "reason": "SPIFFE ID not found or has no active entry."}

    except subprocess.CalledProcessError as e:
        # This handles cases where the entry is not found, as spire-server returns a non-zero exit code
        return {"status": "FAIL", "spiffe_id": spiffe_id, "reason": f"SPIRE server error: Entry not found."}
    except Exception as e:
        return {"status": "ERROR", "message": str(e)}