// Diagnostic only: private SecKeychainCreate/Delete/CFRelease, with no certificate, PFX, SDK or CLR.
#include <CoreFoundation/CoreFoundation.h>
#include <Security/Security.h>
#include <CommonCrypto/CommonDigest.h>
#include <mach/mach.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <time.h>
#include <unistd.h>
#include <errno.h>
#include <limits.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define REPETITIONS 200
static char root[PATH_MAX];
static struct timespec started;
static unsigned created_refs, released_refs, query_releases;
static double elapsed(void) {
    struct timespec now; clock_gettime(CLOCK_MONOTONIC, &now);
    return (double)(now.tv_sec-started.tv_sec)+(double)(now.tv_nsec-started.tv_nsec)/1e9;
}
static void die(const char *message) {
    fprintf(stdout,"{\"kind\":\"failed\",\"message\":\"%s\",\"createdRefs\":%u,\"releasedRefs\":%u,\"elapsedSeconds\":%.6f}\n",message,created_refs,released_refs,elapsed());
    fflush(stdout); exit(1);
}
static void hex(const unsigned char *bytes, size_t length, char *out) {
    const char *alphabet="0123456789abcdef";
    for(size_t i=0;i<length;i++){out[i*2]=alphabet[bytes[i]>>4];out[i*2+1]=alphabet[bytes[i]&15];}
    out[length*2]=0;
}
static void wipe(void *memory, size_t length) {
    volatile unsigned char *bytes=(volatile unsigned char *)memory;
    while(length--)*bytes++=0;
}
static OSStatus keychain_path(SecKeychainRef keychain, char *path) {
    UInt32 length=PATH_MAX-1;
    OSStatus status=SecKeychainGetPath(keychain,&length,path);
    if(status==errSecSuccess && length<PATH_MAX)path[length]=0;
    return status;
}
struct fingerprint { char default_sha[65], search_sha[65]; CFIndex search_count; };
static struct fingerprint fingerprint(const char *stage) {
    SecKeychainRef default_keychain=NULL;
    CFArrayRef search=NULL;
    struct fingerprint out; memset(&out,0,sizeof(out));
    char path[PATH_MAX]; memset(path,0,sizeof(path));
    unsigned char digest[CC_SHA256_DIGEST_LENGTH];
    OSStatus default_status=SecKeychainCopyDefault(&default_keychain);
    OSStatus default_path_status=default_keychain?keychain_path(default_keychain,path):errSecInvalidKeychain;
    if(default_status==errSecSuccess && default_path_status==errSecSuccess){CC_SHA256(path,(CC_LONG)strlen(path),digest);hex(digest,sizeof(digest),out.default_sha);}
    if(default_keychain){CFRelease(default_keychain);query_releases++;default_keychain=NULL;}
    OSStatus search_status=SecKeychainCopySearchList(&search);
    OSStatus search_path_status=errSecSuccess;
    CC_SHA256_CTX hash; CC_SHA256_Init(&hash);
    if(search_status==errSecSuccess && search){
        out.search_count=CFArrayGetCount(search);
        uint64_t count=(uint64_t)out.search_count; CC_SHA256_Update(&hash,&count,sizeof(count));
        for(CFIndex i=0;i<out.search_count;i++){
            // CFArray values are borrowed. Releasing the owned array balances its element references.
            SecKeychainRef borrowed=(SecKeychainRef)CFArrayGetValueAtIndex(search,i);
            memset(path,0,sizeof(path)); OSStatus status=keychain_path(borrowed,path);
            if(status!=errSecSuccess){search_path_status=status;break;}
            uint32_t length=(uint32_t)strlen(path);CC_SHA256_Update(&hash,&length,sizeof(length));CC_SHA256_Update(&hash,path,length);
        }
    }
    CC_SHA256_Final(digest,&hash);hex(digest,sizeof(digest),out.search_sha);
    if(search){CFRelease(search);query_releases++;search=NULL;}
    fprintf(stdout,"{\"kind\":\"fingerprint\",\"stage\":\"%s\",\"defaultStatus\":%d,\"defaultPathStatus\":%d,\"searchStatus\":%d,\"searchPathStatus\":%d,\"defaultSha256\":\"%s\",\"searchSha256\":\"%s\",\"searchCount\":%ld,\"ownedQueryReferencesReleased\":%u}\n",stage,(int)default_status,(int)default_path_status,(int)search_status,(int)search_path_status,out.default_sha,out.search_sha,(long)out.search_count,query_releases);fflush(stdout);
    if(default_status || default_path_status || search_status || search_path_status)die("Read-only keychain fingerprint failed");
    return out;
}
static void checkpoint(const char *stage, unsigned operations) {
    struct mach_task_basic_info info; mach_msg_type_number_t count=MACH_TASK_BASIC_INFO_COUNT;
    kern_return_t status=task_info(mach_task_self(),MACH_TASK_BASIC_INFO,(task_info_t)&info,&count);
    if(status!=KERN_SUCCESS)die("task_info failed");
    struct timespec wall;clock_gettime(CLOCK_REALTIME,&wall);struct tm utc;gmtime_r(&wall.tv_sec,&utc);
    char stamp[40];strftime(stamp,sizeof(stamp),"%Y-%m-%dT%H:%M:%S",&utc);
    fprintf(stdout,"{\"kind\":\"checkpoint\",\"mode\":\"pure-apple\",\"stage\":\"%s\",\"operations\":%u,\"processId\":%d,\"utc\":\"%s.%03ldZ\",\"elapsedSeconds\":%.6f,\"rssBytes\":%llu,\"createdRefs\":%u,\"releasedRefs\":%u,\"managedRuntimePresent\":false}\n",stage,operations,getpid(),stamp,wall.tv_nsec/1000000,elapsed(),(unsigned long long)info.resident_size,created_refs,released_refs);fflush(stdout);
    char next[PATH_MAX];int n=snprintf(next,sizeof(next),"%s/continue-%s",root,stage);if(n<0 || (size_t)n>=sizeof(next))die("Checkpoint path overflow");
    while(access(next,F_OK)!=0){if(elapsed()>180)die("Checkpoint deadline exceeded");struct timespec pause={0,25000000};nanosleep(&pause,NULL);}
}
static int absent(const char *path){struct stat state;if(lstat(path,&state)==0)return 0;return errno==ENOENT;}
static void operation(unsigned iteration) {
    unsigned char random[48];if(SecRandomCopyBytes(kSecRandomDefault,sizeof(random),random)!=errSecSuccess)die("Secure random failed");
    char suffix[33],password[65];hex(random,16,suffix);hex(random+16,32,password);wipe(random,sizeof(random));
    char path[PATH_MAX],backing[PATH_MAX];int n=snprintf(path,sizeof(path),"%s/tmp/native-retention-%s.keychain",root,suffix);
    if(n<0 || (size_t)n>=sizeof(path))die("Fixture path overflow");
    n=snprintf(backing,sizeof(backing),"%s-db",path);if(n<0 || (size_t)n>=sizeof(backing))die("Fixture backing path overflow");
    if(!absent(path)||!absent(backing))die("Generated private fixture path already exists");
    SecKeychainRef keychain=NULL;
    OSStatus create_status=SecKeychainCreate(path,(UInt32)strlen(password),password,false,NULL,&keychain);
    wipe(password,sizeof(password));
    OSStatus path_status=errSecInvalidKeychain,delete_status=INT32_MIN;
    int verified=0,released=0;
    if(keychain){
        created_refs++;
        char actual[PATH_MAX];memset(actual,0,sizeof(actual));path_status=keychain_path(keychain,actual);
        // Only a returned reference whose path is exactly this generated private fixture can be deleted.
        verified=path_status==errSecSuccess && (!strcmp(actual,path)||!strcmp(actual,backing));
        if(verified)delete_status=SecKeychainDelete(keychain);
        // Exactly one CFRelease for this returned owned reference, irrespective of delete status.
        CFRelease(keychain);keychain=NULL;released_refs++;released=1;
    }
    fprintf(stdout,"{\"kind\":\"operation\",\"iteration\":%u,\"createStatus\":%d,\"pathStatus\":%d,\"deleteStatus\":%d,\"returnedRef\":%s,\"privatePathVerified\":%s,\"releasedExactlyOnce\":%s}\n",iteration,(int)create_status,(int)path_status,(int)delete_status,released?"true":"false",verified?"true":"false",released?"true":"false");fflush(stdout);
    if(create_status || path_status || delete_status || !verified || !released)die("Private keychain lifecycle operation failed");
}
int main(int argc,char **argv) {
    clock_gettime(CLOCK_MONOTONIC,&started);
    if(argc!=2 || !realpath(argv[1],root))die("Expected existing private fixture root");
    struct stat state;if(stat(root,&state) || !S_ISDIR(state.st_mode) || (state.st_mode&077))die("Fixture root must be mode0700");
    struct fingerprint before=fingerprint("before");checkpoint("before",0);
    for(unsigned i=1;i<=REPETITIONS;i++){operation(i);if(i==1)checkpoint("first",i);}
    checkpoint("repeated",REPETITIONS);
    struct timespec idle={5,0};while(nanosleep(&idle,&idle)!=0){if(errno!=EINTR)die("Idle delay failed");}
    struct fingerprint after=fingerprint("after");
    checkpoint("idle",REPETITIONS);
    int unchanged=!strcmp(before.default_sha,after.default_sha)&&!strcmp(before.search_sha,after.search_sha)&&before.search_count==after.search_count;
    if(!unchanged || created_refs!=REPETITIONS || released_refs!=REPETITIONS)die("Fingerprint or native ownership guard failed");
    fprintf(stdout,"{\"kind\":\"complete\",\"operations\":200,\"createdRefs\":%u,\"releasedRefs\":%u,\"readOnlyDefaultAndSearchListUnchanged\":true,\"elapsedSeconds\":%.6f,\"fullSoakGate\":false}\n",created_refs,released_refs,elapsed());fflush(stdout);return 0;
}