#!/usr/bin/env python3
"""Read-only authenticated source metadata; never read env or Kubernetes Secrets.

Caller must first confirm the kubeconfig targets railiance01. Raw command
stdout/stderr and exception text are never emitted. No credentials are needed
beyond the caller's separately approved Kubernetes observation/exec lane.
"""
import argparse
import json
import re
import subprocess
from urllib.parse import urlsplit, parse_qs

# SQL projects metadata only; the registration payload itself is never printed.
POD_CODE = '''import json, sqlite3
with sqlite3.connect("file:/data/reuse.db?mode=ro", uri=True) as db:
 rows=db.execute("SELECT repo, json_extract(payload, '$.auth_env'), json_extract(payload, '$.url') FROM registrations WHERE json_extract(payload, '$.auth_env') IS NOT NULL AND json_extract(payload, '$.auth_env') != ''").fetchall()
 print(json.dumps(rows))
'''


def sanitize(rows):
    result = []
    for repo, name, url in rows:
        if not isinstance(repo, str) or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', repo):
            raise ValueError('invalid metadata')
        if not isinstance(name, str) or not re.fullmatch(r'[A-Z][A-Z0-9_]{0,127}', name):
            raise ValueError('invalid metadata')
        parts = urlsplit(url)
        # URLs are untrusted stored data; refuse userinfo/fragments and arbitrary
        # query fields (which could contain credentials). Never echo invalid rows.
        query = parse_qs(parts.query, keep_blank_values=True)
        if (parts.scheme != 'https' or parts.username or parts.password or parts.fragment
            or parts.hostname != 'forgejo.coulomb.social' or parts.port not in (None, 443)
            or not (re.fullmatch(r'/api/v1/repos/coulomb/[a-zA-Z0-9_.-]+/raw/registry/indexes/[a-zA-Z0-9_.-]+', parts.path)
                    or re.fullmatch(r'/coulomb/[a-zA-Z0-9_.-]+/raw/(?:branch|commit|tag)/[a-zA-Z0-9_.-]+/registry/indexes/[a-zA-Z0-9_.-]+', parts.path))
            or any(k != 'ref' for k in query)
            or ('ref' in query and (len(query['ref']) != 1 or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', query['ref'][0])))):
            raise ValueError('unsafe metadata')
        result.append({'repo': repo, 'auth_env': name, 'index_url': url})
    return sorted(result, key=lambda row: row['repo'])


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--kubeconfig', required=True)
    args = parser.parse_args()
    try:
        proc = subprocess.run(['kubectl', '--kubeconfig', args.kubeconfig, '-n', 'reuse',
            'exec', 'deployment/reuse-surface', '-c', 'reuse-surface', '--', 'python3', '-c', POD_CODE],
            capture_output=True, timeout=30)
        if proc.returncode:
            raise RuntimeError('inventory unavailable')
        rows = sanitize(json.loads(proc.stdout))
    except Exception:
        print(json.dumps({'status': 'refused_or_unavailable', 'raw_output_discarded': True}))
        return 1
    print(json.dumps({'status': 'verified', 'authenticated_source_count': len(rows), 'sources': rows}, indent=2))
    return 0

if __name__ == '__main__':
    raise SystemExit(main())