#!/usr/bin/env python3
"""Synchronize VM2 runtime secrets, then execute a command with paths only."""

from __future__ import annotations

import argparse
import json
import os
import subprocess
import sys
import tempfile
from pathlib import Path

from secrets_loader import LoaderError, load_json, run


def public_config(path: Path) -> dict[str, str]:
    result: dict[str, str] = {}
    for number, raw in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        if "=" not in line:
            raise LoaderError(f"invalid non-secret config at line {number}")
        key, value = line.split("=", 1)
        if not key or key in result:
            raise LoaderError(f"invalid/duplicate non-secret key at line {number}")
        result[key] = value
    return result


def selected_config(public: dict[str, str], explicit: Path | None) -> tuple[str, Path]:
    source = public.get("SECRETS_SOURCE")
    if source not in {"selectel", "file"}:
        raise LoaderError("SECRETS_SOURCE must explicitly be selectel or file")
    if explicit:
        return source, explicit
    environment = public.get("APP_ENV", "production")
    return source, Path(f"/etc/han/secrets/vm2-{environment}.{source}.json")


def prepare(config_path: Path, source: str, synchronize: bool) -> dict[str, str]:
    document = load_json(config_path)
    if document.get("mode") != source:
        raise LoaderError("loader mode does not match SECRETS_SOURCE")
    runtime = Path(str(document.get("runtime_dir", "")))
    state_path = runtime / "state.json"
    if synchronize:
        run(config_path)
        descriptor, temporary = tempfile.mkstemp(prefix=".state.", dir=runtime)
        with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
            json.dump(
                {"version": 1, "source": source, "loader_config": str(config_path.resolve())},
                stream,
                separators=(",", ":"),
            )
            stream.write("\n")
            stream.flush()
            os.fsync(stream.fileno())
        os.chmod(temporary, 0o600)
        os.replace(temporary, state_path)
    if not state_path.is_file():
        raise LoaderError("runtime secrets are not synchronized")
    state = load_json(state_path)
    if state != {
        "version": 1,
        "source": source,
        "loader_config": str(config_path.resolve()),
    }:
        raise LoaderError("runtime secret state does not match selected configuration")
    manifest = runtime / "manifest"
    entries: dict[str, str] = {}
    for line in manifest.read_text(encoding="utf-8").splitlines():
        key, separator, value = line.partition("=")
        if not separator or key in entries or not Path(value).is_file():
            raise LoaderError("runtime secret manifest is invalid")
        entries[key] = value
    if set(entries) != set(document.get("secrets", {})):
        raise LoaderError("runtime secret manifest does not match configuration")
    child = dict(os.environ)
    child["HAN_SECRETS_ACTIVE"] = "1"
    child["HAN_RUNTIME_SECRET_DIR"] = str(runtime)
    child["HAN_RUNTIME_SECRET_MANIFEST"] = str(manifest)
    for key, value in entries.items():
        child[f"{key}_FILE"] = value
    return child


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("action", choices=("sync", "run"))
    parser.add_argument("--config", type=Path, default=Path(".env"))
    parser.add_argument("--loader-config", type=Path)
    arguments, command = parser.parse_known_args()
    if command and command[0] == "--":
        command.pop(0)
    if arguments.action == "run" and not command:
        parser.error("run requires a command after --")
    try:
        source, config = selected_config(public_config(arguments.config), arguments.loader_config)
        child = prepare(config, source, arguments.action == "sync")
    except (LoaderError, OSError, ValueError, json.JSONDecodeError) as exc:
        print(f"han-secrets-vm2: {exc}", file=sys.stderr)
        return 1
    if arguments.action == "sync":
        return 0
    if os.name == "nt":
        return subprocess.call(command, env=child)
    os.execvpe(command[0], command, child)
    return 127


if __name__ == "__main__":
    raise SystemExit(main())