#!/usr/bin/env python3
"""Confirm backup-primary version 2 replaced the placeholder. No key material."""

from __future__ import annotations

import json
import subprocess
from pathlib import Path

RECEIPT = Path("/home/worsch/.local/state/railiance/receipts/backup-pair-version2.json")
PATHS = {
    "coulomb-social": "platform/workloads/coulomb-social/backup-primary",
    "email-connect": "platform/workloads/email-connect/backup-primary",
}
FIELDS = ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY")


def kv(path):
    proc = subprocess.run(["bao", "kv", "get", "-format=json", path], capture_output=True)
    if proc.returncode:
        raise SystemExit(61)
    return json.loads(proc.stdout)["data"]["data"]


def main():
    loaded = {name: kv(path) for name, path in PATHS.items()}
    rows = []
    access_keys = []
    for name, values in loaded.items():
        row = {"application": name, "fields": sorted(values)}
        for field in FIELDS:
            value = values.get(field)
            row[field] = {
                "present": isinstance(value, str) and bool(value),
                "pending": value == "PENDING",
                "length": len(value) if isinstance(value, str) else 0,
            }
        access_keys.append(values.get("AWS_ACCESS_KEY_ID"))
        rows.append(row)
    receipt = {
        "applications": rows,
        "access_keys_differ": access_keys[0] != access_keys[1],
        "secrets_differ": (
            loaded["coulomb-social"].get("AWS_SECRET_ACCESS_KEY")
            != loaded["email-connect"].get("AWS_SECRET_ACCESS_KEY")
        ),
    }
    RECEIPT.parent.mkdir(mode=0o700, exist_ok=True)
    RECEIPT.write_text(json.dumps(receipt, indent=2) + "\n")
    RECEIPT.chmod(0o600)


if __name__ == "__main__":
    try:
        main()
    except SystemExit:
        raise
    except Exception:
        raise SystemExit(62) from None