Chapter 1 — Provider: encrypt data and publish an ODRL policy

import geopandas as gpd
from pathlib import Path

DATA_DIR = Path("data")
DATASET_PATH = DATA_DIR / "hamburg-buildings-example.gpkg"

if not DATASET_PATH.exists():
    raise FileNotFoundError(
        f"{DATASET_PATH} not found. Fetch it first:\n"
        "    python3 ../../scripts/fetch_example_data.py"
    )

gdf = gpd.read_file(DATASET_PATH)
print(f"Dataset: {DATASET_PATH}")
print(f"Buildings: {len(gdf)}, CRS: {gdf.crs}")
print(f"Columns: {list(gdf.columns)}")
gdf.drop(columns=gdf.geometry.name).head()

from fair_data_access.encrypt import encrypt_file, generate_key

KEYS_DIR = Path("keys")

# Generate a random 256-bit symmetric key
dataset_key = generate_key()

# Encrypt the CSV — produces a .enc file alongside the original
encrypted_path, _ = encrypt_file(str(DATASET_PATH), key=dataset_key)
encrypted_path = Path(encrypted_path)

print(f"Original:  {DATASET_PATH} ({DATASET_PATH.stat().st_size:,} bytes)")
print(f"Encrypted: {encrypted_path} ({encrypted_path.stat().st_size:,} bytes)")
print()
print("The encrypted file is safe to host publicly.")
print("Without the dataset key, it is computationally infeasible to decrypt.")

import json

POLICY_PATH = Path("policies/hamburg-buildings-example.jsonld")
policy = json.loads(POLICY_PATH.read_text())

print("=== ODRL Access Policy ===")
print(json.dumps(policy, indent=2))

CONSUMER_DID = "did:web:fair2adapt.github.io:fair-data-access:example-consumer"
CONSUMER_DID_DOC_PATH = KEYS_DIR / "did" / "example-consumer.json"

consumer_did_doc = json.loads(CONSUMER_DID_DOC_PATH.read_text())

# The purpose the consumer declares in their access request. This policy mirrors
# the production Hamburg policy and constrains use/reproduce to
# dpv:AcademicResearch, so this permits. Change it to e.g. "PublicBenefit" to
# watch the deny path close the loop.
declared_purpose = "AcademicResearch"

print(f"Access request received from: {CONSUMER_DID}")
print(f"Declared purpose: {declared_purpose}")
print(f"Consumer's public key curve: {consumer_did_doc['verificationMethod'][0]['publicKeyJwk']['crv']}")

# This is the same evaluator the GitHub Actions enforcement workflow calls —
# the decision below is *binding*, not illustrative: if it denies, no key is
# wrapped and no grant is issued.
from fair_data_access.policy import evaluate_policy

permitted = evaluate_policy(policy, requester_did=CONSUMER_DID, purpose=declared_purpose)

if permitted:
    print(f"✅ PERMIT — declared purpose '{declared_purpose}' satisfies the policy constraint")
else:
    print(f"❌ DENY — declared purpose '{declared_purpose}' is not permitted by this policy")

from fair_data_access.did import get_public_key_pem
from fair_data_access.keys import wrap_key, save_wrapped_key

# Extract the consumer's public key from their DID document
consumer_public_pem = get_public_key_pem(consumer_did_doc)

# The access decision gates everything downstream. A denied request must not
# produce a wrapped key — otherwise the policy is decorative.
if not permitted:
    raise PermissionError(
        f"Access denied: declared purpose {declared_purpose!r} is not permitted "
        "by the governing ODRL policy. No key is wrapped and no grant is issued."
    )

# Wrap the dataset key for this specific consumer
wrapped_envelope = wrap_key(dataset_key, consumer_public_pem)

# Save the wrapped key (in production, this goes to GitHub Pages or S3)
WRAPPED_KEY_PATH = KEYS_DIR / "wrapped-dataset-key.json"
save_wrapped_key(wrapped_envelope, str(WRAPPED_KEY_PATH))

print(f"Wrapped key saved to: {WRAPPED_KEY_PATH}")
print(f"Wrapped envelope size: {len(wrapped_envelope)} bytes")
print()
print("This file is safe to host publicly — only the consumer's private key")
print("can unwrap it.")

from datetime import datetime, timezone

grant_record = {
    "type": "odrl:Agreement",
    "assignee": CONSUMER_DID,
    "target": policy["permission"][0]["target"],
    # Read from the policy file so there is exactly one place to update once the
    # policy nanopublication for this dataset is published. None until then.
    "policy_nanopub": policy.get("_nanopub_uri"),
    "granted_actions": [
        p["action"] for p in policy["permission"]
    ],
    "declared_purpose": declared_purpose,
    "timestamp": datetime.now(timezone.utc).isoformat(),
}

print("=== Access Grant Record ===")
print(json.dumps(grant_record, indent=2))
print()
print("In production, this is published as a signed nanopublication.")
print("Anyone can verify that the grant was issued by the policy publisher.")