#!/usr/bin/env python3
"""Leakage + repeatability audit for aws-vpc-flowlog-sanitizer output.

Usage:  python3 audit_output.py sanitized.jsonl

Checks two things no human wants to eyeball across millions of lines:
  1. None of the known raw secrets survive anywhere in the sanitized text.
  2. A source IP repeated across records collapses to one stable token
     (deterministic correlation is preserved).
"""
import json
import sys
from pathlib import Path

raw = Path(sys.argv[1] if len(sys.argv) > 1 else "sanitized.jsonl").read_text()

# The raw values from the two-line fixture; swap in your own.
for secret in ("185.220.101.5", "10.0.1.45", "10.0.2.20",
               "123456789012", "eni-0a1b2c3d4e5f6789a"):
    print(f"raw-value-absent {secret}:", secret not in raw)

records = [json.loads(line) for line in raw.splitlines() if line.strip()]


def strings(value):
    """Yield every string anywhere in a nested JSON structure."""
    if isinstance(value, dict):
        for item in value.values():
            yield from strings(item)
    elif isinstance(value, list):
        for item in value:
            yield from strings(item)
    elif isinstance(value, str):
        yield value


per_record_tokens = []
for record in records:
    tokens = sorted({s for s in strings(record)
                     if s.startswith(("pub-ip:", "priv-ip:"))})
    per_record_tokens.append(tokens)

print("records:", len(records))
print("pseudonym tokens by record:", per_record_tokens)
common = (set(per_record_tokens[0]).intersection(per_record_tokens[1])
          if len(per_record_tokens) == 2 else set())
print("stable repeated-IP tokens:", sorted(common))
print("deterministic correlation preserved:", bool(common))