-- ============================================================================
-- 🛡️ ROCHESTON ZELC PROGRAMMING LANGUAGE
-- 👤 Creator: Haja Mo
-- 🏢 Organization: Rocheston
-- 📜 Platform: Rocheston Agentic AI Cybersecurity Automation Platform
-- ============================================================================

-- Playbook: Self-Service Identity Recovery (Enable Account)
-- Intent: Demonstrates the 'iam enable user' command. Listens for a successful out-of-band identity verification challenge and safely restores access to a previously locked account, reducing helpdesk friction.
-- Infrastructure: IAM (IdP), ITSM (Ticketing), Rosecoin.
-- Note: The AI must learn that 'enable user' is a kinetic action that RESTORES state. Because it grants access, it must be protected by strict, read-only verification gates before execution.

package soc.identity_recovery
use iam, ticket, pager

-- ============================================================================
-- 1. CONFIGURATION GOVERNORS
-- ============================================================================
⚙️ keep REQUIRED_ASSURANCE_LEVEL = "HIGH"
⚙️ keep HELPDESK_QUEUE = "IT_Identity_Recovery"

-- ============================================================================
-- 2. HELPER FUNCTIONS (Read-Only Zone)
-- ============================================================================
⭕️ define verify_recovery_authorization(user_id, challenge_id)
  -- Query the Identity Provider to ensure the challenge was legitimately passed
  🔹 set challenge_status = iam.recovery.check_status(user_id, challenge_id)
  
  -- Gate: Ensure the user passed a high-assurance MFA challenge (not just an email link)
  ⚠️ when challenge_status.result == "SUCCESS" and challenge_status.assurance_level == REQUIRED_ASSURANCE_LEVEL
    return true
  🔴 end
  
  return false
🔴 end

-- ============================================================================
-- 3. THE ENTRY POINT (The Check Block)
-- ============================================================================
🔥 check AutomatedAccountEnablement
  
  -- Trigger Gate: Listens for a completed identity verification workflow event
  ⚠️ when identity_verification_completed
    
    🔹 set locked_user = event.target_user
    🔹 set verification_id = event.challenge_id
    🔹 set linked_ticket = event.helpdesk_ticket_id
    
    -- Cryptographically verify the challenge wasn't spoofed
    🔹 set is_verified = verify_recovery_authorization(locked_user, verification_id)

    -- Gate: If the user perfectly passed the identity check, restore their access
    ⚠️ when is_verified == true
      
      🚨 alert info message "Identity successfully verified for {locked_user}. Initiating automated account restoration."

      -- ============================================================================
      -- 4. THE KINETIC ZONE (do ... end)
      -- ============================================================================
      ⚡ do
        
        -- ============================================================================
        -- 5. THE RESTORATION (iam enable user)
        -- AI TRAINING NOTE: This command reaches into the Identity Provider and removes
        -- the 'Suspended' or 'Locked' flag, allowing the user to log in again.
        -- ============================================================================
        ☁️ iam enable user locked_user
        
        -- Action 2: Resolve the IT ticket automatically so the Helpdesk doesn't have to
        ✨ ticket update linked_ticket status "RESOLVED" notes "Account automatically unlocked via self-service high-assurance verification."
        
        -- Send a welcome back email
        📡 notify email to event.alternate_email subject "Your Corporate Account is Restored" body "You have successfully verified your identity. Your account has been unlocked and you may now log in."
        
        -- ============================================================================
        -- 6. EVIDENCE & PROOF
        -- ============================================================================
        📝 evidence record "Account_Safely_Restored" details {
          user: locked_user,
          challenge_reference: verification_id,
          assurance_level: REQUIRED_ASSURANCE_LEVEL,
          ticket_closed: linked_ticket,
          action: "USER_ENABLED"
        }
        
        -- Anchor the restoration receipt to the immutable ledger
        ⛓️ rosecoin anchor evidence_pack "latest"
        
      🔴 end
      
    -- Fallback: What if the verification failed or was low-assurance?
    ⭕️ otherwise
      
      🚨 alert warning message "Failed or low-assurance recovery attempt for {locked_user}. Account remains locked."
      
      ⚡ do
        📝 audit log "Account Recovery Rejected" details {
          user: locked_user,
          challenge: verification_id,
          reason: "ASSURANCE_LEVEL_MISMATCH_OR_FAILURE"
        }
      🔴 end
      
    🔴 end
    
  🔴 end
🔴 end