#!/usr/bin/env python3
# /// script
# requires-python = ">=3.12,<3.13"
# ///
"""Create one external two-event Task26 runtime authority and credentials."""

from __future__ import annotations

import argparse
import os
import shutil
import stat
import sys
from dataclasses import dataclass
from pathlib import Path
from typing import Sequence

from gateway.platforms.task26_runtime_authority import (
    FileCandidateAuthoritySource,
    append_external_authority,
    digest,
)

from first_customer_invite_contract import (
    CANDIDATE,
    ControllerError,
    exclusive_json,
    json_object,
    require_private_file,
    sha256_file,
)


BASE_CANDIDATE = "d1109d8f78aaccf949ec4f664d9e62584c3cca33032030518bc3e2d712239112"
BASE_PASS = "31d7daa60dad93dce41761b2c36f1fe3ec38e8f9257761fd9b6771d83ac32a76"
CANDIDATE_PASS = "8f26a2929dd349967ecc39df3b750fdd84a2ded1dfd09ffe4ea27263746a7604"


@dataclass(frozen=True, slots=True)
class Permission:
    profile: Path
    package_root: Path
    authority_root: Path
    pin_path: Path
    candidate_path: Path
    receipt_path: Path
    source_id: str


def _permission(path: Path) -> Permission:
    require_private_file(path)
    value = json_object(path)
    authorization = Path(str(value.get("authorization_path"))).resolve()
    expected = (
        value.get("schema")
        == "dualcoach-runtime-authority-bootstrap-permission-v1"
        and value.get("base_candidate") == BASE_CANDIDATE
        and value.get("base_pass_digest") == BASE_PASS
        and value.get("candidate_digest") == CANDIDATE
        and value.get("candidate_pass_digest") == CANDIDATE_PASS
        and value.get("authorization_sha256") == sha256_file(authorization)
        and value.get("script_sha256") == sha256_file(Path(__file__).resolve())
    )
    launch = json_object(authorization)
    if (
        not expected
        or launch.get("status") != "AUTHORIZED_ONE_FIRST_CUSTOMER_LINK"
        or launch.get("candidate_digest") != CANDIDATE
    ):
        raise ControllerError("runtime authority permission binding mismatch")
    try:
        permission = Permission(
            profile=Path(str(value["profile"])).resolve(),
            package_root=Path(str(value["package_root"])).resolve(),
            authority_root=Path(str(value["authority_root"])).resolve(),
            pin_path=Path(str(value["pin_path"])).resolve(),
            candidate_path=Path(str(value["candidate_path"])).resolve(),
            receipt_path=Path(str(value["receipt_path"])).resolve(),
            source_id=str(value["source_id"]),
        )
    except KeyError as exc:
        raise ControllerError("runtime authority permission is malformed") from exc
    outputs = (
        permission.authority_root,
        permission.pin_path,
        permission.candidate_path,
        permission.receipt_path,
    )
    if (
        not permission.source_id
        or not permission.profile.is_dir()
        or not permission.package_root.is_dir()
        or any(output.exists() for output in outputs)
        or any(
            output.parent.is_symlink()
            or not output.parent.is_dir()
            or stat.S_IMODE(output.parent.stat().st_mode) != 0o700
            for output in outputs
        )
    ):
        raise ControllerError("runtime authority output boundary mismatch")
    return permission


def _exclusive_text(path: Path, value: str) -> None:
    descriptor = os.open(
        path,
        os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC | os.O_NOFOLLOW,
        0o600,
    )
    try:
        os.fchmod(descriptor, 0o600)
        os.write(descriptor, value.encode())
        os.fsync(descriptor)
    finally:
        os.close(descriptor)


def bootstrap(permission: Permission) -> None:
    created: list[Path] = []
    try:
        first = append_external_authority(
            permission.authority_root,
            source_id=permission.source_id,
            candidate_digest=BASE_CANDIDATE,
            action="qualify",
            historical_pass_digest=BASE_PASS,
            reason="qualified DualCoach v1.0 rollback base",
        )
        created.append(permission.authority_root)
        second = append_external_authority(
            permission.authority_root,
            source_id=permission.source_id,
            candidate_digest=CANDIDATE,
            action="qualify",
            historical_pass_digest=CANDIDATE_PASS,
            reason="qualified DualCoach v1.1 first-customer runtime",
        )
        registry = json_object(
            permission.authority_root / "candidate-authority/registry.json"
        )
        events = registry.get("events")
        if not isinstance(events, list) or len(events) != 2:
            raise ControllerError("runtime authority event cardinality mismatch")
        pin_unsigned: dict[str, object] = {
            "schema": "task26-authority-pin-v1",
            "authority_root": str(permission.authority_root),
            "source_id": permission.source_id,
            "genesis_sha256": second["genesis_sha256"],
            "registry_head_sha256": second["registry_head_sha256"],
            "ledger_head_sha256": second["ledger_head_sha256"],
            "event_count": 2,
        }
        exclusive_json(
            permission.pin_path,
            {**pin_unsigned, "pin_sha256": digest(pin_unsigned)},
        )
        created.append(permission.pin_path)
        _exclusive_text(permission.candidate_path, CANDIDATE + "\n")
        created.append(permission.candidate_path)
        source = FileCandidateAuthoritySource(
            permission.pin_path,
            forbidden_roots=(permission.profile, permission.package_root),
        )
        with source.authorize(CANDIDATE, "activation"):
            pass
        exclusive_json(
            permission.receipt_path,
            {
                "schema": "dualcoach-runtime-authority-bootstrap-receipt-v1",
                "status": "PASS_PREPARED",
                "candidate_digest": CANDIDATE,
                "source_id": permission.source_id,
                "genesis_sha256": second["genesis_sha256"],
                "registry_head_sha256": second["registry_head_sha256"],
                "ledger_head_sha256": second["ledger_head_sha256"],
                "event_count": 2,
                "pin_sha256": sha256_file(permission.pin_path),
                "candidate_file_sha256": sha256_file(permission.candidate_path),
                "base_event_sha256": first["registry_head_sha256"],
                "current_event_sha256": second["registry_head_sha256"],
            },
        )
    except (ControllerError, OSError, ValueError, KeyError, TypeError):
        for path in reversed(created):
            if path.is_dir():
                shutil.rmtree(path, ignore_errors=True)
            else:
                path.unlink(missing_ok=True)
        raise


def main(argv: Sequence[str] | None = None) -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--permission", type=Path, required=True)
    args = parser.parse_args(argv)
    try:
        bootstrap(_permission(args.permission))
    except (ControllerError, OSError, ValueError, KeyError, TypeError) as exc:
        sys.stderr.write(f"FAIL: {exc}\n")
        return 2
    print('{"status":"PASS_PREPARED"}')
    return 0


if __name__ == "__main__":
    raise SystemExit(main())