"""Attended capture/seal entry point; frozen capture and export implementations."""

import argparse
import fcntl
import json
import os
import pwd
import signal

import vergabe_pilot_export as export
import vergabe_pilot_point as point
import vergabe_pilot_snapshot as snapshot
from vergabe_pilot_recovery_store import Refused, private_directory, require


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--run", required=True)
    parser.add_argument("mode", choices=("check", "capture", "seal", "resume"))
    args = parser.parse_args()
    point.run_time(args.run)
    owner = pwd.getpwnam("tegwick")
    require(os.geteuid() == 0 and os.environ.get("SUDO_USER") == owner.pw_name
            and os.environ.get("SUDO_UID") == str(owner.pw_uid), "founder_node_sudo_required")
    if args.mode == "check":
        _, fixture, _ = snapshot.preflight(args.run)
        print(json.dumps({"status": "ready_for_attended_capture", "runtime_mutations": False,
                          "fixture_present": fixture["fixture_present"], "helm_revision": snapshot.REVISION}))
        return 0
    if not snapshot.BASE.exists():
        snapshot.BASE.mkdir(mode=0o700)
    private_directory(snapshot.BASE)
    fd = os.open(snapshot.BASE / "operation.lock", os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
    with os.fdopen(fd, "w") as lock:
        fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
        if args.mode == "resume":
            private_directory(snapshot.BASE / args.run)
            require(point.read_private(snapshot.BASE / "active.json")["run_id"] == args.run,
                    "resume_must_match_active_run")
            journal = point.read_private(snapshot.BASE / args.run / "journal.json")
            require(journal["run_id"] == args.run, "journal_run_mismatch")
            result = snapshot.resume(journal)
            if result["helper_cleanup_confirmed"]:
                snapshot.checkpoint(snapshot.BASE / "active.json", {"run_id": args.run, "status": "resumed_after_failure"})
            print(json.dumps({"status": "application_resumed", "run_id": args.run,
                              "helper_cleanup_confirmed": result["helper_cleanup_confirmed"],
                              "backup_acceptance": False}))
            return 0 if result["helper_cleanup_confirmed"] else 1
        if args.mode == "capture":
            require(args.run != point.BASELINE and not (snapshot.BASE / args.run).exists(), "fresh_run_required")
            # Refuse a forgotten older interrupted pause before creating any new one.
            active = snapshot.BASE / "active.json"
            if active.exists() or active.is_symlink():
                old = point.read_private(active)
                require(old["status"] in {"captured_and_resumed", "resumed_after_failure"}, "previous_capture_requires_review_or_resume")
            baseline, fixture, status = snapshot.preflight(args.run)
            code = snapshot.execute(args.run, baseline, fixture, status)
            if code:
                return code
        point.select_node(args.run)
        export.main()
    return 0


if __name__ == "__main__":
    os.umask(0o077)
    def interrupted(signum, frame):
        raise Refused("attended_backup_interrupted")
    signal.signal(signal.SIGHUP, interrupted)
    signal.signal(signal.SIGTERM, interrupted)
    try:
        raise SystemExit(main())
    except Exception as error:  # noqa: BLE001 — never expose private subprocess/parser output
        print(json.dumps({"status": "attended_backup_failed", "failure": str(error) if isinstance(error, Refused)
                          else "attended_backup_node_error", "details_suppressed": True}))
        raise SystemExit(1)