AI Pokémon Assistant with Agent-Pass

/**
 * AI Pokémon Assistant with Agent-Pass Protection
 * 
 * This assistant helps users find Pokémon information while maintaining
 * strict security controls and audit trails through Agent-Pass.
 */

import { AgentPass } from '@agent-pass/core';
import fetch from 'node-fetch';

interface PokemonData {
  name: string;
  id: number;
  types: Array<{ type: { name: string } }>;
  stats: Array<{ base_stat: number; stat: { name: string } }>;
  height: number;
  weight: number;
}

interface RegionalConstraint {
  allowedRegions: string[];
  maxPokemonId: number;
}

class SecurePokemonAssistant {
  private agentPass: AgentPass;
  private apiCallCount = 0;
  private lastReset = Date.now();

  constructor() {
    this.agentPass = new AgentPass();
  }

  async setupAuthentication(userName: string) {
    console.log(`🔐 Setting up Agent-Pass authentication for ${userName}`);
    
    // Create user (controller) identity
    const controller = await this.agentPass.createControllerIdentity({
      alias: `pokemon-trainer-${userName}`,
      keyType: 'Ed25519'
    });

    // Create AI assistant (agent) identity
    const agent = await this.agentPass.createAgentIdentity({
      alias: 'pokemon-assistant-ai',
      keyType: 'Ed25519'
    });

    // Issue controlled access credential with strict constraints
    const credential = await this.agentPass.createAgentCapabilityCredential(
      controller,
      agent,
      {
        scope: [
          'read:pokemon',
          'read:moves', 
          'read:types',
          'read:abilities'
        ],
        constraints: {
          // Rate limiting
          maxApiCallsPerHour: 100,
          maxApiCallsPerDay: 500,
          
          // Regional restrictions (Gen 1-3 only)
          allowedRegions: ['kanto', 'johto', 'hoenn'],
          maxPokemonId: 386, // Up to Gen 3
          
          // Time constraints
          timeWindow: {
            start: '09:00',
            end: '18:00',
            timezone: 'UTC'
          },
          
          // Business constraints
          allowedDomains: ['pokeapi.co'],
          purpose: 'pokemon-research-assistant'
        },
        expirationDate: new Date(Date.now() + 24 * 60 * 60 * 1000) // 24 hours
      }
    );

    console.log(`✅ Authentication setup complete`);
    console.log(`   Controller: ${controller.did}`);
    console.log(`   Agent: ${agent.did}`);
    console.log(`   Scopes: ${credential.credentialSubject.scope.join(', ')}`);

    return { controller, agent, credential };
  }

  async authenticateForApiCall(agent: any, controller: any, credential: any) {
    // Generate fresh challenge for each API session
    const challenge = await this.agentPass.createChallenge({
      domain: 'pokeapi.co',
      purpose: 'pokemon-data-access'
    );

    // Create verifiable presentation
    const presentation = await this.agentPass.createPresentation(
      agent,
      controller,
      [credential],
      challenge
    );

    // Verify authentication with constraints
    const verification = await this.agentPass.verifyPresentation(
      presentation,
      challenge,
      {
        domain: 'pokeapi.co',
        requiredScope: ['read:pokemon'],
        enforceConstraints: true
      }
    );

    if (!verification.verified) {
      throw new Error(`Authentication failed: ${verification.reason}`);
    }

    return verification;
  }

  async checkRateLimit(): Promise<boolean> {
    const hourAgo = Date.now() - (60 * 60 * 1000);
    if (this.lastReset < hourAgo) {
      this.apiCallCount = 0;
      this.lastReset = Date.now();
    }
    
    return this.apiCallCount < 100; // Max 100 calls per hour
  }

  async getPokemonInfo(pokemonName: string, auth: any): Promise<PokemonData> {
    // Check rate limiting
    if (!await this.checkRateLimit()) {
      throw new Error('Rate limit exceeded: Max 100 API calls per hour');
    }

    // Validate scope permission
    const hasPermission = await this.agentPass.hasScope(auth, 'read:pokemon');
    if (!hasPermission) {
      throw new Error('Insufficient permissions for Pokemon data access');
    }

    try {
      // Make authenticated API call to PokéAPI
      console.log(`🔍 Fetching Pokemon data for: ${pokemonName}`);
      console.log(`   Authorized by: ${auth.controllerDid}`);
      console.log(`   Agent: ${auth.agentDid}`);
      
      const response = await fetch(`https://pokeapi.co/api/v2/pokemon/${pokemonName.toLowerCase()}`);
      
      if (!response.ok) {
        throw new Error(`PokéAPI error: ${response.status} - ${response.statusText}`);
      }

      const pokemonData: PokemonData = await response.json();
      
      // Enforce regional constraints
      if (pokemonData.id > 386) {
        throw new Error(`Pokemon ${pokemonName} (ID: ${pokemonData.id}) is outside allowed regions (Gen 1-3)`);
      }

      this.apiCallCount++;
      
      console.log(`✅ Successfully retrieved ${pokemonData.name} data`);
      console.log(`   API calls today: ${this.apiCallCount}/100`);

      return pokemonData;

    } catch (error) {
      console.error(`❌ Failed to fetch Pokemon data: ${error.message}`);
      throw error;
    }
  }

  formatPokemonResponse(pokemon: PokemonData): string {
    const types = pokemon.types.map(t => t.type.name).join(', ');
    const stats = pokemon.stats
      .map(s => `${s.stat.name}: ${s.base_stat}`)
      .join(', ');

    return [
      `🎮 **${pokemon.name.toUpperCase()}** (#${pokemon.id})`,
      `Type(s): ${types}`,
      `Height: ${pokemon.height / 10}m | Weight: ${pokemon.weight / 10}kg`,
      `Base Stats: ${stats}`,
      ``,
      `✅ Data accessed with Agent-Pass authentication`,
      `🔒 Rate limited and scoped access enforced`
    ].join('\n');
  }
}

// Demo Usage
async function demonstratePokemonAssistant() {
  console.log('🚀 AI Pokémon Assistant with Agent-Pass Protection');
  console.log('================================================');

  const assistant = new SecurePokemonAssistant();

  try {
    // Setup authentication for user 'ash'
    const { controller, agent, credential } = await assistant.setupAuthentication('ash');

    // Authenticate for this session
    const auth = await assistant.authenticateForApiCall(agent, controller, credential);

    console.log('\n🎯 Testing Pokemon lookups...');
    
    // Test 1: Valid Pokemon within constraints
    const pikachu = await assistant.getPokemonInfo('pikachu', auth);
    console.log('\n' + assistant.formatPokemonResponse(pikachu));

    // Test 2: Another valid Pokemon
    const charizard = await assistant.getPokemonInfo('charizard', auth);
    console.log('\n' + assistant.formatPokemonResponse(charizard));

    // Test 3: Pokemon outside regional constraints (should fail)
    try {
      await assistant.getPokemonInfo('garchomp', auth); // Gen 4 Pokemon
    } catch (error) {
      console.log(`\n❌ Regional constraint enforced: ${error.message}`);
    }

    console.log('\n✨ Demo completed successfully!');
    console.log('   All API calls were authenticated and audited');
    console.log('   Rate limits and regional constraints enforced');
    console.log('   Full user attribution maintained');

  } catch (error) {
    console.error(`❌ Demo failed: ${error.message}`);
  }
}

// Run the demonstration
demonstratePokemonAssistant();