#!/usr/bin/env python3
"""Fixed Vergabe registration using the existing guarded KeyCape rollout lane."""
import importlib.util
from pathlib import Path
from types import SimpleNamespace

ROOT = Path(__file__).resolve().parent
spec = importlib.util.spec_from_file_location('portal_rollout', ROOT / 'portal-client-rollout.py')
rollout = importlib.util.module_from_spec(spec)
spec.loader.exec_module(rollout)
CLIENT = {
    'clientId': 'vergabe-demo-company',
    'displayName': 'Vergabe Demo Company',
    'redirectUris': ['https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/'],
    'allowedScopes': ['openid', 'profile', 'groups'],
    'grantTypes': ['authorization_code'],
    'clientType': 'public',
}
# Reuse the owner's byte-preserving insertion, CAS, cluster pin and safe receipts.
# The portal-specific legacy migration branch is explicitly unreachable here.
original_replacement = rollout.replacement
rollout.portal = SimpleNamespace(CLIENT_ID=CLIENT['clientId'], CLIENT=CLIENT)


def replacement(secret):
    _, config, _ = rollout.pin.issuer_document(secret)
    for client in config.get('clients', []):
        if 'client_credentials' not in client.get('grantTypes', []):
            rollout.require(not client.get('roles') and not client.get('serviceSubject'),
                            'browser_service_identity_fields_block_new_binary')
        if client.get('clientId') == CLIENT['clientId']:
            rollout.require(client == CLIENT, 'existing_vergabe_registration_differs')
    return original_replacement(secret)


rollout.replacement = replacement

if __name__ == '__main__':
    raise SystemExit(rollout.main())