"""Proposed fixed issuer ESO source contract for RPF-1.3-T4 / NK48-R5-F2.

Pure public metadata only. No API/credential/Secret access or apply path. This
new declaration requires independent Platform review before type integration.
The delivery lane may use only external_secret(); store provisioning is a
separate owner action and is never delegated by this module.
"""
from __future__ import annotations

from copy import deepcopy
from pathlib import Path
import re

import yaml

ROOT = Path(__file__).resolve().parents[1]
TEMPLATE = ROOT / 'manifests/templates/keycape-issuer-eso.yaml'


class Refused(ValueError):
    """Fixed issuer metadata differs; never return an owner delivery receipt."""


def documents(client_id: str) -> tuple[dict, dict]:
    # Match the frozen type client_id pattern and existing adapter's derived bound.
    # No caller can supply a store name/kind/namespace or an OpenBao path.
    if not isinstance(client_id, str) or not re.fullmatch(r'[a-z0-9][a-z0-9-]{1,62}', client_id):
        raise Refused('bounded admitted client_id required')
    if len('keycape-' + client_id + '-client') > 63:
        raise Refused('derived issuer reference exceeds existing adapter bound')
    store, external = yaml.safe_load_all(TEMPLATE.read_text().format(client_id=client_id))
    return store, external


def external_secret(client_id: str) -> dict:
    """The ONLY document the proposed delivery capability may apply."""
    return deepcopy(documents(client_id)[1])


def _matching_public_resource(observed: dict, expected: dict) -> None:
    if not isinstance(observed, dict):
        raise Refused('public resource observation required')
    metadata = observed.get('metadata')
    if not isinstance(metadata, dict):
        raise Refused('resource metadata required')
    expected_namespace = expected['metadata'].get('namespace')
    namespace_matches = (metadata.get('namespace') == expected_namespace
                         if expected_namespace else metadata.get('namespace') in (None, ''))
    if (observed.get('apiVersion') != expected['apiVersion']
            or observed.get('kind') != expected['kind']
            or metadata.get('name') != expected['metadata']['name']
            or not namespace_matches
            or observed.get('spec') != expected['spec']):
        raise Refused('fixed issuer resource differs')
    status = observed.get('status')
    conditions = status.get('conditions', []) if isinstance(status, dict) else []
    if not isinstance(conditions, list) or not any(
            isinstance(c, dict) and c.get('type') == 'Ready' and c.get('status') == 'True'
            for c in conditions):
        raise Refused('fixed issuer resource not ready')


def require_fixed_store(observed: dict, client_id: str) -> None:
    """Refuse a missing/drifted/not-ready store; never create it through delivery."""
    _matching_public_resource(observed, documents(client_id)[0])


def require_ready_delivery(observed: dict, client_id: str) -> None:
    """Spec equality and Ready precede a created/NO_CHANGE owner receipt."""
    _matching_public_resource(observed, documents(client_id)[1])