"""Build one synthetic present_existing intake envelope (INFD-WP-0010-T02 release check).

The envelope pins an approval id the caller names and a deliberately wrong binding
digest, so a successful approval read always ends in a 409 refusal and no memo is
stored, no budget is spent and no approval is created, entered or consumed. It only
prints JSON; posting it is a separate, founder-run step (see
deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md). The content is synthetic and secret-free.
"""

import argparse
from datetime import datetime, timezone
import hashlib
import json
import sys

ACTOR = "service:nk-bind-executor"
SUBMITTER = "nk-bind-executor"
PROFILE_ACTIONS = ["bounded-execution"]
WRONG_DIGEST = "sha256:" + "0" * 64
WORKLOAD = "http://informed-decision-workload.informed-decision.svc.cluster.local:8081/v1/memos"
TOKEN_FILE = "/var/run/secrets/informed-decision-intake/token"

# Runs inside the founder's probe pod (python from the service image). Prints status and the
# refusal body only; never prints the token.
POSTER = """import json, urllib.error, urllib.request
token = open(%r).read().strip()
request = urllib.request.Request(%r, data=ENVELOPE.encode(), method="POST",
    headers={"Authorization": "Bearer " + token, "Content-Type": "application/json"})
try:
    response = urllib.request.urlopen(request, timeout=20)
    print(response.status, response.read().decode()[:400])
except urllib.error.HTTPError as error:
    print(error.code, error.read().decode()[:400])
""" % (TOKEN_FILE, WORKLOAD)


def build(approval_id, stamp):
    memo_id = "probe-" + stamp
    item_id = memo_id + "-packet"
    content = ("Synthetic release probe for the present_existing intake profile. "
               "It is refused by design and must never be shown for review.\n")
    packet_hash = "sha256:" + hashlib.sha256(content.encode()).hexdigest()
    memo = {
        "id": memo_id, "version": 1, "sealed": False, "locale": "en",
        "question": "Synthetic release probe: is this refused before review?",
        "requested_act": "approve", "binding_level": "organizational", "step_kind": "approve",
        "brief": "Synthetic present_existing release probe; never bound.",
        "binding": {"justification": None, "terms": None,
                    "principal": {"id": "pending-human-session", "kind": "person", "role": "reviewer",
                                  "display_name": "Named reviewer in net-kingdom-admins", "identifiers": []},
                    "target": {"environment": "prod", "id": "probe:" + memo_id, "kind": "bounded-execution",
                               "label": "synthetic release probe", "requires_new_bind": False}},
        "packet": [{"item_id": item_id, "label": item_id, "hash": packet_hash}],
        "highlights": [],
        "approval_id": approval_id, "approval_binding_digest": WRONG_DIGEST,
    }
    return {
        "kind": "informed-decision.memo-intake", "version": 1,
        "idempotency_key": memo_id, "memo_class": "bounded-execution",
        "review_group": "net-kingdom-admins", "drafted_by": "informed-decision-release-probe",
        "approval_intent": {"action": "bounded-execution", "principal": "admin",
                            "purpose": "Synthetic present_existing release probe",
                            "target": {"admission_id": "PROBE-" + stamp, "admission_digest": WRONG_DIGEST}},
        "memo": memo,
        "packet": [{"item_id": item_id, "media_type": "text/plain", "content": content}],
    }


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--approval-id", required=True, help="existing approval UUID, or a random UUID")
    parser.add_argument("--program", action="store_true",
                        help="print a self-contained python program that posts the envelope (for `python -`)")
    parser.add_argument("--stamp", default=datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S"))
    args = parser.parse_args()
    envelope = build(args.approval_id, args.stamp)
    # Offline self-check against the same validator intake uses.
    from informed_decision.intake import PresentExisting, SubmitterGrant, validate_submission
    validate_submission(envelope, submitter_id=SUBMITTER,
                        grant=SubmitterGrant(SUBMITTER, frozenset({"bounded-execution"}),
                                             frozenset({"net-kingdom-admins"})),
                        present_existing=PresentExisting(ACTOR, frozenset(PROFILE_ACTIONS)))
    raw = json.dumps(envelope, separators=(",", ":"))
    sys.stdout.write("ENVELOPE = %r\n%s" % (raw, POSTER) if args.program else raw + "\n")


if __name__ == "__main__":
    main()