"""Run native delivery/scope/rotation acceptance; no attended admin or secret output."""
import copy,json,subprocess,time,uuid
from pathlib import Path
from keycape_factor_activate import CLUSTER,kubectl
ROOT=Path(__file__).resolve().parents[1]
def run():
 if kubectl("get","ns","kube-system","-o","json")["metadata"]["uid"]!=CLUSTER:raise ValueError()
 cron=kubectl("-n","sso","get","cronjob","keycape-factor-renewer","-o","json")
 spec=copy.deepcopy(cron["spec"]["jobTemplate"]["spec"])
 spec.update(activeDeadlineSeconds=300,backoffLimit=0)
 p=spec["template"]["spec"];p["serviceAccountName"]="keycape-factor-eso"
 p["containers"][0]["command"]=["python3","-c",(ROOT/"scripts/keycape_factor_delivery_probe.py").read_text()]
 p["volumes"].append({"name":"factor","secret":{"secretName":"keycape-factor-read","defaultMode":288}})
 p["containers"][0]["volumeMounts"].append({"name":"factor","mountPath":"/factor","readOnly":True})
 suffix=uuid.uuid4().hex[:8];name="keycape-factor-proof-"+suffix
 kubectl("create","-f","-","-o","json",payload={"apiVersion":"batch/v1","kind":"Job","metadata":{"name":name,"namespace":"sso"},"spec":spec})
 deadline=time.monotonic()+310;rotating=False
 while time.monotonic()<deadline:
  r=subprocess.run(["kubectl","-n","sso","logs","job/"+name],capture_output=True,text=True,timeout=15)
  results=[]
  if r.returncode==0:
   for line in r.stdout.splitlines():
    try:results.append(json.loads(line))
    except ValueError:pass
  if results and not rotating:
   if results[0].get("phase")!="awaiting_rotation":raise ValueError()
   renewal={"apiVersion":"batch/v1","kind":"Job","metadata":{"name":"keycape-factor-rotate-"+suffix,"namespace":"sso"},"spec":cron["spec"]["jobTemplate"]["spec"]}
   kubectl("create","-f","-","-o","json",payload=renewal);rotating=True
   print(json.dumps({"phase":"waiting_for_mounted_rotation","job":name}),flush=True)
  if results and "phase" not in results[-1]:
   result={k:v for k,v in results[-1].items() if isinstance(v,bool)}
   result["job"]=name
   return result
  time.sleep(5)
 raise TimeoutError()
if __name__=="__main__":
 try:result=run()
 except Exception:result={"success":False,"failure":"native acceptance failed or timed out"}
 print(json.dumps(result),flush=True);raise SystemExit(0 if result.get("success") else 1)