#!/usr/bin/env bash
# Demo "money shot": prove the cloud (Bedrock/AgentCore) only ever saw a TOKEN,
# never the real name.
#
#   scripts/prove.sh          run a fresh round trip, then prove it
#   scripts/prove.sh --last   skip the round trip; prove against the last few
#                             minutes of trace (snappy: run right after the UI demo)
#
# Env overrides: REGION, ENDPOINT (round-trip URL), NAME (the PII to hunt for).
set -uo pipefail

REGION="${REGION:-ap-southeast-1}"
ENDPOINT="${ENDPOINT:-https://hncb-deid.apim-apac-demo.com/tokenize}"
NAME="${NAME:-王小明}"
QUERY="${QUERY:-請幫我整理${NAME}最近三個月的理財往來，並給我下次拜訪話術。}"
export AWS_PAGER=""

# Discover the AgentCore runtime trace log group (no hard-coded runtime id).
LG=$(aws logs describe-log-groups --region "$REGION" \
  --log-group-name-prefix /aws/bedrock-agentcore/runtimes/ \
  --query "logGroups[?contains(logGroupName,'hncb') && ends_with(logGroupName,'-DEFAULT')].logGroupName | [0]" \
  --output text 2>/dev/null)
if [ -z "$LG" ] || [ "$LG" = "None" ]; then
  echo "✗ couldn't find the AgentCore runtime log group (is the runtime deployed?)"; exit 1
fi

# Count trace events (since START ms) whose message contains $1.
count() {
  aws logs filter-log-events --region "$REGION" --log-group-name "$LG" \
    --start-time "$1" --filter-pattern "$2" --no-paginate \
    --query 'events[].eventId' --output text 2>/dev/null | tr '\t' '\n' | grep -c . || true
}

if [ "${1:-}" = "--last" ]; then
  START=$(( ($(date +%s) - 300) * 1000 ))
  TOKEN=$(aws logs filter-log-events --region "$REGION" --log-group-name "$LG" \
    --start-time "$START" --filter-pattern 'CUST_' --no-paginate \
    --query 'events[*].message' --output text 2>/dev/null | grep -oE 'CUST_[0-9]+' | head -1)
else
  echo "▶ Advisor asks about ${NAME}"
  echo "    \"${QUERY}\""
  echo
  echo "▶ Running the de-identification round trip through the gateway …"
  START=$(( $(date +%s) * 1000 - 3000 ))
  RESP=$(curl -s -m 60 -X POST "$ENDPOINT" -H 'content-type: application/json' \
    -d "{\"query\":\"${QUERY}\"}")
  TOKEN=$(printf '%s' "$RESP" | grep -oE 'CUST_[0-9]+' | head -1)
  if [ -z "$TOKEN" ]; then echo "  ✗ no token minted (detector miss?) — re-run"; exit 1; fi
  echo "  ✓ ${NAME}  →  ${TOKEN}     (this token is all that left for the cloud)"
  echo "  ✓ advisor got talking points; identity restored on-prem"
fi
[ -z "$TOKEN" ] && { echo "✗ no token seen in the recent trace — run a query first"; exit 1; }

echo
echo "▶ Proof — searching the cloud (Bedrock/AgentCore) trace:"

# Wait for the trace to flush (token to show up), then hunt for the name.
THITS=0
for _ in $(seq 1 15); do
  THITS=$(count "$START" "\"$TOKEN\"")
  [ "${THITS:-0}" -gt 0 ] && break
  sleep 4
done
NHITS=$(count "$START" "\"$NAME\"")

printf "    token  %-14s → %s hits   ← the model reasoned on this\n" "$TOKEN" "$THITS"
printf "    name   %-14s → %s hits   ← the model NEVER saw it\n" "$NAME" "$NHITS"
echo
if [ "${THITS:-0}" -gt 0 ] && [ "${NHITS:-0}" -eq 0 ]; then
  echo "  ✅ The cloud only ever handled a token. PII never left the on-prem zone."
else
  echo "  ⚠ trace still settling (token=$THITS, name=$NHITS). Give it a few seconds and re-run:"
  echo "      scripts/prove.sh --last"
fi