#!/usr/bin/env bash
# capabilities.sh — enforce the capability tier as a QUERY over emitted
# relations plus a shipped policy file. The compiler records the program's kind
# and its call graph; deciding what that tier may call is not an emitter's job.
set -uo pipefail
REL="${1:?usage: capabilities.sh <relations-file> [policy]}"
POLICY="${2:-$(dirname "${BASH_SOURCE[0]}")/capabilities.rel}"
[ -f "$REL" ] || exit 0
KIND=$(grep -m1 '^program calls is_kind:' "$REL" | sed 's/.*is_kind://')
[ -n "$KIND" ] || KIND=utility
V=0
while read -r kind rel names; do
    [ "$kind" = "$KIND" ] && [ "$rel" = "prohibits_within" ] || continue
    IFS=',' read -ra NAMES <<< "$names"
    for n in "${NAMES[@]}"; do
        while read -r caller _ callee; do
            [ "$callee" = "$n" ] || continue
            printf "capability violation: '%s' programs may not call '%s' (called from %s)\n" "$KIND" "$n" "$caller"
            V=$((V+1))
        done < <(sort -u "$REL")
    done
done < <(grep -v '^#' "$POLICY" | grep -v '^[[:space:]]*$')
[ "$V" -eq 0 ] && echo "capabilities: clean ($KIND)"
exit "$V"