"""Canonical executable permission package and no-follow loader."""

from __future__ import annotations

import hashlib
import json
import os
from pathlib import Path
from typing import ClassVar

from pydantic import BaseModel, ConfigDict, Field, ValidationError, model_validator

from .contract import ContractError, PackageContract
from .fdio import open_control_root


class PermissionPackageError(RuntimeError):
    """The executable permission package is absent or unauthenticated."""


class RuntimeContract(BaseModel):
    """Concrete installed-store and observer execution binding."""

    model_config: ClassVar[ConfigDict] = ConfigDict(frozen=True, extra="forbid")
    customer_key_file: Path
    observer_baseline_log: Path
    observer_output_log: Path
    observer_timer_unit: str
    observer_service_unit: str
    observer_timeout_seconds: int = Field(gt=0, le=3600)


class PermissionPackage(BaseModel):
    """Final canonical permission package consumed by the CLI."""

    model_config: ClassVar[ConfigDict] = ConfigDict(frozen=True, extra="forbid")
    schema_version: str = Field(alias="schema")
    contract: PackageContract
    runtime: RuntimeContract
    package_digest: str = Field(pattern=r"^[0-9a-f]{64}$")

    def unsigned_bytes(self) -> bytes:
        """Encode every field except the package digest."""
        value = self.model_dump(mode="json", by_alias=True, exclude={"package_digest"})
        return json.dumps(value, sort_keys=True, separators=(",", ":")).encode()

    def canonical_bytes(self) -> bytes:
        """Encode the final package canonically."""
        value = self.model_dump(mode="json", by_alias=True)
        return json.dumps(value, sort_keys=True, separators=(",", ":")).encode() + b"\n"

    @model_validator(mode="after")
    def validate_digest(self) -> PermissionPackage:
        """Require a digest derived from every executable binding."""
        if self.schema_version != "nutricoach-day-status-continuity-permission-v1":
            raise PermissionPackageError("permission schema")
        if hashlib.sha256(self.unsigned_bytes()).hexdigest() != self.package_digest:
            raise PermissionPackageError("permission digest")
        return self


def finalize_permission(
    contract: PackageContract,
    runtime: RuntimeContract,
) -> PermissionPackage:
    """Derive and validate the final digest without omitting any binding."""
    draft = PermissionPackage.model_construct(
        schema_version="nutricoach-day-status-continuity-permission-v1",
        contract=contract,
        runtime=runtime,
        package_digest="0" * 64,
    )
    digest = hashlib.sha256(draft.unsigned_bytes()).hexdigest()
    return PermissionPackage.model_validate(
        {
            "schema": draft.schema_version,
            "contract": contract.model_dump(mode="json", by_alias=True),
            "runtime": runtime.model_dump(mode="json"),
            "package_digest": digest,
        }
    )


def load_permission(root: Path) -> PermissionPackage:
    """Load one canonical 0400 package beneath an exact private root."""
    with open_control_root(root) as descriptor:
        package = os.open(
            "package.json",
            os.O_RDONLY | os.O_CLOEXEC | os.O_NOFOLLOW | os.O_NONBLOCK,
            dir_fd=descriptor,
        )
        try:
            info = os.fstat(package)
            named = os.stat(
                "package.json",
                dir_fd=descriptor,
                follow_symlinks=False,
            )
            if (
                info.st_uid != os.geteuid()
                or info.st_gid != os.getegid()
                or info.st_mode & 0o7777 != 0o400
                or info.st_nlink != 1
                or (info.st_dev, info.st_ino) != (named.st_dev, named.st_ino)
            ):
                raise PermissionPackageError("permission identity")
            payload = os.read(package, info.st_size + 1)
        finally:
            os.close(package)
    try:
        parsed = PermissionPackage.model_validate_json(payload)
    except (ContractError, ValidationError) as error:
        raise PermissionPackageError("permission payload") from error
    if parsed.canonical_bytes() != payload:
        raise PermissionPackageError("permission canonical bytes")
    return parsed