
    j                        d Z ddlmZ ddlZddlZddlZddlmZmZmZ ddl	m
Z
 ddlmZ dZ ed	      Zd
Z G d de      ZddZddZddZddZdd	 	 	 	 	 	 	 	 	 	 	 	 	 ddZddgZy)zFIndependent validation of the gateway's strict staff-membership proof.    )annotationsN)UTCdatetime	timedelta)Path)Mappingz%telegram-staff-membership-evidence-v1   )minutes)
candidate_digestcandidate_core_digestcandidate_inventory_digesthermes_wheel_sha256profile_wheel_sha256deployment_receipt_sha256registry_sha256config_sha256staff_chat_inventory_sha256activation_journal_sha256c                      e Zd Zy)StaffMembershipEvidenceErrorN)__name__
__module____qualname__     v/home/cube/projects/richard/.worktrees/nutricoach-v140-impl/dualcoach/profile/checkin_cli/staff_membership_evidence.pyr   r      s    r   r   c                P    t        j                  | ddd      j                         S )NT),:)ensure_ascii	sort_keys
separators)jsondumpsencodevalues    r   
_canonicalr(      s     ::e$$:V]]__r   c                Z    t        j                  t        |             j                         S N)hashlibsha256r(   	hexdigestr&   s    r   _digestr.      s    >>*U+,6688r   c                d    t        j                  | j                               j                         S r*   )r+   r,   
read_bytesr-   )paths    r   _file_digestr2   "   s!    >>$//+,6688r   c                   	 | j                         }t        j                  | j                  d            }| j                         s`t        j                  |j                        rAt        j                  |j                        dk7  s|j                  dk7  st        |t              st        | d      |S # t        t
        t        j                  f$ r}t        | d      |d }~ww xY w)Nzutf-8)encodingz is unavailablei     z is invalid)lstatr#   loads	read_textOSErrorUnicodeDecodeErrorJSONDecodeErrorr   
is_symlinkstatS_ISREGst_modeS_IMODEst_nlink
isinstancedict)r1   labelmetadatar'   excs        r   _private_jsonrG   &   s    O::<

4>>7>;< 	h.>.>!?||H,,-6(:K:Kq:PeT**eWK+@AAL ')=)=> O*eWO+DE3NOs   5B7 7C)C$$C))nowc                  t        |       }|j                         s||z  }	 |j                  d      }|j                  |j                               st        d      t        |d      }	|	j                  d      t        k7  s|	j                  d      d	k7  rt        d
      |	j                         D 
ci c]  \  }
}|
dk7  s|
| }}
}|	j                  d      t        |      k7  rt        d      |	j                  d      |k7  st        |	j                  d            k7  rt        d      |	j                  d      t        |      k7  rt        d      |dz  }|	j                  d      t        |      k7  rt        d      t        D ]R  }|	j                  |      }t        |t              r!t!        |      dk7  st#        d |D              sEt        d| d       |	j                  d      }t        |t              st        d      t        |      }|j                         s||z  }t        |d      }t        |      |	d   k7  rt        d      dD ](  }|	|   |j                  |      k7  st        d| d       |	j                  d       }t        |t$              rt        |      |	j                  d!      k7  rt        d"      t'               }t'               }|D ]  }t        |t(              st        d"      |j                  d#      d$k(  r!|j+                  |j                  d%             S|j                  d#      d&k(  rj|j                  d%      |j                  d'      k(  rGt-        t        |j                  d%                  d(kD  r!|j+                  |j                  d%             t        d"       |	j                  d)      }|	j                  d*      }t        |t$              r|D ch c]$  }t        |t(              s|j                  d%      & c}|k7  sit#        d+ |D              sWt        |t$              rG|D ch c]$  }t        |t(              s|j                  d%      & c}|k7  st#        fd,|D              rt        d-      |	j                  d.      }|	j                  d/      }|	j                  d0      }t        |t              r*|r(t        |t              r|rt/        |      t,        us|d(k  rt        d1      	 t1        j2                  t        |	d2               }t1        j2                  t        |	d3               }t1        j2                  t        |	d4               }|xs t1        j8                  t:              }t#        d6 |||fD              s*||cxk  r|cxk  r|k  rn t        d7      ||z
  t<        kD  rt        d7      t        |      |	d!   |t        |      d8S # t        t        f$ r}t        d      |d}~ww xY wc c}}
w c c}w c c}w # t4        t6        f$ r}t        d5      |d}~ww xY w)9z=Validate all current bindings without mutating profile state.T)strictz(staff membership evidence is unavailableNz-staff membership evidence escapes the profilezstaff membership evidenceschemaphasepre_activationz$staff membership evidence is invalidevidence_sha256z+staff membership evidence digest is invalidcustomer_idcustomer_user_idz*staff membership customer binding is staler   z*staff membership registry binding is stalezconfig.yamlr   z(staff membership config binding is stale@   c              3  $   K   | ]  }|d v 
 yw)0123456789abcdefNr   ).0	characters     r   	<genexpr>z5validate_staff_membership_evidence.<locals>.<genexpr>Q   s     REyy(::Es   zstaff membership z is missing or staledeployment_receipt_pathz.staff membership deployment receipt is missingz#staff membership deployment receiptr   z,staff membership deployment receipt is stale)r   r   r   r   r   z deployment binding is stalestaff_chat_inventoryr   z%staff membership inventory is invalidkindmembership_chatchat_idprivate_staff_dmstaff_user_idr   membership_resultsprivate_dm_resultsc              3  h   K   | ]*  }t        |t               xs |j                  d       dv , yw)status>   leftkickedN)rB   r   get)rT   rows     r   rV   z5validate_staff_membership_evidence.<locals>.<genexpr>s   s5     ujtcfz#w//^37783DL^3^^jts   02c              3     K   | ]I  }t        |t               xs2 |j                  d       duxs t        |j                  d            k(   K yw)identity_separatedTr[   N)rB   r   rd   str)rT   re   rP   s     r   rV   z5validate_staff_membership_evidence.<locals>.<genexpr>v   s_      VMTc "#w// B377;O3PX\3\ B#''),-1AABMTs   AAz'customer absence evidence is incompletesubscription_epoch_idbootstrap_session_idbootstrap_generationz-staff membership lifecycle binding is invalidsubscription_armed_at_utcrequest_started_at_utcobserved_at_utcz'staff membership timestamps are invalidc              3  8   K   | ]  }|j                   d u   y wr*   )tzinfo)rT   r'   s     r   rV   z5validate_staff_membership_evidence.<locals>.<genexpr>   s     I.HUELLD .Hs   z"staff membership evidence is stale) staff_membership_evidence_sha256r    membership_subscription_epoch_idstaff_membership_evidence_path)r   is_absoluteresolver9   RuntimeErrorr   is_relative_torG   rd   SCHEMAitemsr.   rh   r2   _HEX_FIELDSrB   lenanylistsetr   addinttyper   fromisoformatKeyError
ValueErrorrH   r   MAX_AGE)r1   profile_rootregistry_pathrO   rP   rH   evidence_pathresolvedrF   payloadkeyr'   bodyconfig_pathfielddeployment_valuedeployment_path
deployment	inventory	group_idsprivate_idsre   
membershipprivateepochsession
generationarmedstartedobservedcurrents       `                          r   "validate_staff_membership_evidencer   3   s   
 JM$$&$}4` (((5 ""<#7#7#9:*+Z[[H&ABG{{8&'++g*>BR*R*+QRR)0U:3CCT<TCJDU{{$%6*+XYY{{=![0CDV8W4X\l4l*+WXX{{$%m)DD*+WXX.K{{?#|K'@@*+UVVE"5#&#e**:RERR.1B5'I]/^__	 
 {{#<=&,*+[\\+,O&&(&80UVJO$0K(LL*+YZZ L5>Z^^E22.1B5'Ie/fgg L 23Ii&')*<Li@j*j*+RSS UI"uK#w'./VWW776?//MM#''),-ggfo!33'')$(@@c#''),-.2OOCGGI././VWW  12Jkk./Gz4(.8UjsJsG<T	"jUYbbujtuugt,.5RgsC9Q	"gRVaa VMTV V*+TUUKK/0Ekk01G34Juc"%z'37OW^Js*j1n*+Z[[_&&s73N+O'PQ((W5M-N)OP))#g6G.H*IJ &X\\#&GIugx.HIIG:x:7:*+OPP ?F>PSZ>Z*+OPP,8,B'./L'M,1*-h-	 Y \" `*+UV\__` V\ V S j! _*+TU[^^_sT   W4 5XX2XXX"X"A#X' 4XXX'Y6YYr   )r'   objectreturnbytes)r'   r   r   rh   )r1   r   r   rh   )r1   r   rD   rh   r   dict[str, object])r1   r   r   r   r   r   rO   rh   rP   rh   rH   zdatetime | Noner   r   )__doc__
__future__r   r+   r#   r=   r   r   r   pathlibr   typingr   rx   r   rz   r   r   r(   r.   r2   rG   r   __all__r   r   r   <module>r      s    L "    - -  	0
A
	: 	`99
 EI[
[!%[6:[[(+[2A[ [| *+O
Pr   