#!/usr/bin/env python3
"""Contained WSL launcher, limited to the approved OpenBao OIDC callback."""
import subprocess
import sys
from urllib.parse import urlsplit, parse_qs


def allowed(url):
    try:
        u=urlsplit(url); q=parse_qs(u.query)
        return (u.scheme=='https' and u.hostname=='kc.coulomb.social'
            and u.port in (None,443) and u.username is None and u.password is None
            and not u.fragment and not any(c in url for c in '\r\n\x00')
            and q.get('redirect_uri') in (['http://localhost:8250/oidc/callback'],['http://127.0.0.1:8250/oidc/callback']))
    except ValueError: return False


def main():
    if len(sys.argv)!=2 or not allowed(sys.argv[1]): return 1
    try:
        r=subprocess.run(['/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe',
            '-NoProfile','-NonInteractive','-Command',
            '$ErrorActionPreference="Stop"; $u=[Console]::In.ReadLine(); Start-Process -FilePath $u'],
            input=(sys.argv[1]+'\n').encode(),stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
        return int(r.returncode!=0)
    except Exception: return 1
if __name__=='__main__': raise SystemExit(main())