# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-security-clearance-boundaries-must-be-scrubbed-before-committing-public-memory.md
# Remnant Warrant:    https://corpusfetch.com/c/what-security-clearance-boundaries-must-be-scrubbed-before-committing-public-memory.warrant.json
# Markdown SHA-256:   96f0defb82b1c3935b614cbb8c3fb279256461dbc142ba58d0029a980ce4f283
# Code AST SHA-256:   a62bc03ecf55b58686a541b80595dff8a5edff66a7a802d7af24fd42e0feef85
# Verified Classes:   SecurityTier, ScrubVerdict, MemoryPayload, ScrubbingResult, ClearanceBoundaryScrubber
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json
import re


class SecurityTier(Enum):
    PUBLIC = auto()
    TENANT_SCOPED = auto()
    INTERNAL_RESTRICTED = auto()
    HIGHLY_PRIVILEGED = auto()


class ScrubVerdict(Enum):
    SAFE_TO_PERSIST = auto()
    SCRUBBED_AND_PERSISTED = auto()
    REJECTED_UNRECOVERABLE_SECRET = auto()


@dataclass(frozen=True)
class MemoryPayload:
    conclusion: str
    metadata: tuple[tuple[str, str], ...]
    origin_clearance: SecurityTier


@dataclass(frozen=True)
class ScrubbingResult:
    verdict: ScrubVerdict
    sanitized_payload: MemoryPayload | None
    scrubbed_categories: frozenset[str]
    result_digest: str


class ClearanceBoundaryScrubber:
    """
    Evaluates and scrubs memory payloads before they are committed to a
    destination memory layer with broader access controls.
    """

    SECRET_PATTERNS = [
        re.compile(r"(?i)(bearer\s+[a-z0-9\-_\.]+)"),
        re.compile(r"(?i)(api[_-]?key[\"'\s:=]+[a-z0-9\-_]+)"),
        re.compile(r"(?i)(password[\"'\s:=]+[^\s]+)"),
    ]

    TENANT_PATTERNS = [
        re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),  # SSN / PII
        re.compile(r"\b10\.\d+\.\d+\.\d+\b"),  # Internal IPs
    ]

    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def scrub(
        cls, payload: MemoryPayload, destination_tier: SecurityTier
    ) -> ScrubbingResult:
        # Gate 1: If destination is stricter or equal, no scrubbing required
        if destination_tier.value <= payload.origin_clearance.value:
            return ScrubbingResult(
                verdict=ScrubVerdict.SAFE_TO_PERSIST,
                sanitized_payload=payload,
                scrubbed_categories=frozenset(),
                result_digest=cls._hash(payload.conclusion),
            )

        scrubbed_conclusion = payload.conclusion
        scrubbed_categories: set[str] = set()

        # Gate 2: Scrub Secrets
        for pattern in cls.SECRET_PATTERNS:
            if pattern.search(scrubbed_conclusion):
                scrubbed_conclusion = pattern.sub("[REDACTED_SECRET]", scrubbed_conclusion)
                scrubbed_categories.add("HIGH_ENTROPY_CREDENTIALS")

        # Gate 3: Scrub PII and Internal Topology
        for pattern in cls.TENANT_PATTERNS:
            if pattern.search(scrubbed_conclusion):
                scrubbed_conclusion = pattern.sub("[REDACTED_TENANT_DATA]", scrubbed_conclusion)
                scrubbed_categories.add("TENANT_SPECIFIC_PII")

        # Gate 4: Fail closed if the entire conclusion was essentially a secret
        if len(scrubbed_conclusion.strip()) <= 20 and scrubbed_categories:
            return ScrubbingResult(
                verdict=ScrubVerdict.REJECTED_UNRECOVERABLE_SECRET,
                sanitized_payload=None,
                scrubbed_categories=frozenset(scrubbed_categories),
                result_digest=cls._hash("REJECTED"),
            )

        sanitized = MemoryPayload(
            conclusion=scrubbed_conclusion,
            metadata=payload.metadata,
            origin_clearance=SecurityTier.PUBLIC,  # Downgrade clearance
        )

        digest_payload = {
            "conclusion": sanitized.conclusion,
            "categories": tuple(sorted(scrubbed_categories)),
        }
        digest = cls._hash(
            json.dumps(digest_payload, sort_keys=True, separators=(",", ":"))
        )

        return ScrubbingResult(
            verdict=ScrubVerdict.SCRUBBED_AND_PERSISTED,
            sanitized_payload=sanitized,
            scrubbed_categories=frozenset(scrubbed_categories),
            result_digest=digest,
        )