#!/usr/bin/env python3
"""Silent attended current-source and governed provider history recovery proof."""
import argparse
import configparser
import hmac
from urllib.parse import urlsplit,unquote
from datetime import datetime,timezone
import hashlib
import importlib.util
import json
import os
from pathlib import Path
import subprocess
import tempfile
import uuid

from root_grant_attended import Bao, RECORD_ID, atomic_json, check_baseline, digest, require_attended
from migrate_nextcloud_backup_account import HOST, OPERATOR_PATH, LANE, FOLDER, LABEL, quota, request, ocs

VALIDATOR_DIGEST='9156e399c8d92a45b817bfc3738c89843487ce57e1718ed747f804f95cc719bb'
SCHEMA_DIGEST='bb6cd6da5dc48eddcf118ae78c2cacfafd5f860098fd8a8368fe6bc845776d07'
INDEPENDENT_ESCROW=Path('/home/worsch/.config/age/railiance-backup.key')


def checked_bundle(state_path, validator):
    state=json.loads(state_path.read_text())
    if state.get('pending') or validator.validate(state['document']) or state['record_id']!=RECORD_ID or digest(state['document'])!=state['digest']:
        raise FinishFailure('retained_state_invalid')
    history=[]
    for path in sorted((state_path.parent/'history').glob('*.json')):
        if path.is_symlink() or path.stat().st_size>262144:
            raise FinishFailure('history_invalid')
        receipt=json.loads(path.read_text())
        if validator.validate(receipt['document']) or receipt['record_id']!=RECORD_ID or receipt['digest']!=digest(receipt['document']):
            raise FinishFailure('history_invalid')
        history.append(receipt)
    if state not in history:
        raise FinishFailure('latest_history_missing')
    return state,json.dumps({'baseline':state,'history':history},sort_keys=True,separators=(',',':')).encode()


def historical_config_comparison(config_path, values):
    if not config_path.exists():
        return {"historical_config_present":False,"historical_share_matches_current_lane":None}
    try:
        config=configparser.ConfigParser(interpolation=None)
        config.read(config_path)
        remote=config['nextcloud-backup']
        candidates=[remote.get('user','')]+unquote(urlsplit(remote.get('url','')).path).split('/')
        matched=any(hmac.compare_digest(value,values['NC_WEBDAV_TOKEN']) for value in candidates if value)
        return {"historical_config_present":True,"historical_share_matches_current_lane":matched,
                "historical_credential_status":"current-lane-incident" if matched else "historical-owner-and-revocation-unverified"}
    except Exception:
        return {"historical_config_present":True,"historical_share_matches_current_lane":None,
                "historical_credential_status":"comparison-unavailable"}



def inspect_share(lane, operator, inventory=None, network=None, progress=lambda stage, **details: None):
    """Owner metadata and depth-zero public probes only; never upload or change shares."""
    inventory=ocs if inventory is None else inventory
    network=request if network is None else network
    values=lane['data']
    if operator['BACKUP_USERNAME']!='Backup':
        raise FinishFailure('governed_owner_mismatch')
    token=values['NC_WEBDAV_TOKEN']
    upload=values['NC_WEBDAV_URL']
    if not token or upload != HOST+'/public.php/dav/filesdrop/'+token:
        raise FinishFailure('current_lane_contract_mismatch')
    auth=(operator['BACKUP_USERNAME'],operator['BACKUP_PASSWORD'])
    progress('share_inventory')
    # Existing owner-scoped inventory, filtered provider-side to reviewed folder.
    from urllib.parse import quote
    shares=inventory(auth,'?path='+quote(FOLDER,safe=''))
    if not isinstance(shares,list) or len(shares)>1000:
        raise FinishFailure('share_inventory_invalid')
    labelled=[x for x in shares if x.get('label')==LABEL]
    bound=[x for x in shares if isinstance(x.get('token'),str) and hmac.compare_digest(x['token'],token)]
    result={'labelled_share_present':bool(labelled),'labelled_share_unique':len(labelled)==1,
            'current_token_found_in_reviewed_folder':bool(bound),'current_token_unique':len(bound)==1,
            'read_only_diagnostic':True,'provider_mutations_performed':False,'backup_roundtrip_proved':False}
    if len(bound)==1:
        share=bound[0]
        expiry=share.get('expiration')
        expired=None
        if expiry:
            try:
                parsed=datetime.fromisoformat(expiry).replace(tzinfo=timezone.utc)
                expired=parsed<=datetime.now(timezone.utc)
            except (TypeError,ValueError):pass
        result.update(current_share_label_matches=share.get('label')==LABEL,
          current_share_owner_matches=share.get('uid_owner')=='Backup',
          current_share_path_matches=share.get('path')==FOLDER,
          current_share_public_link=share.get('share_type') in (3,'3'),
          current_share_create_only=share.get('permissions') in (4,'4'),
          current_share_password_indicator=bool(share.get('password')),
          current_share_expiry_present=bool(expiry),current_share_expired=expired)
    progress('share_route_probes')
    body=b'<d:propfind xmlns:d="DAV:"><d:prop><d:resourcetype/></d:prop></d:propfind>'
    headers={'Depth':'0','Content-Type':'application/xml','X-Requested-With':'XMLHttpRequest'}
    # No listing of children, no PUT; response bodies remain captured and discarded.
    for name,url,credentials in (
        ('current_route',upload,(token,'')),
        ('documented_route',HOST+'/public.php/dav/files/'+token,(token,'')),
        ('documented_route_no_basic',HOST+'/public.php/dav/files/'+token,None)):
        code,_=network(url,'PROPFIND',body,credentials,headers)
        if type(code) is not int or not 100<=code<=599:
            raise FinishFailure('share_probe_invalid')
        result[name+'_http_status']=code
        result[name+'_classification']=('authentication_rejected' if code==401 else
            'capability_denied' if code==403 else 'not_found' if code==404 else
            'properties_returned' if code==207 else 'other_status')
    return result

def roundtrip(bundle, lane, operator, network=None, get_quota=None, progress=lambda stage, **details: None):
    network=request if network is None else network
    get_quota=quota if get_quota is None else get_quota
    progress('provider_contract')
    values=lane['data']
    if operator['BACKUP_USERNAME']!='Backup':
        raise FinishFailure('governed_owner_mismatch')
    auth=(operator['BACKUP_USERNAME'],operator['BACKUP_PASSWORD'])
    upload=values['NC_WEBDAV_URL']
    if not upload.startswith(HOST+'/public.php/dav/filesdrop/') or values['NC_WEBDAV_TOKEN']!=upload.rsplit('/',1)[-1]:
        raise FinishFailure('current_lane_contract_mismatch')
    key=(values['AGE_PRIVATE_KEY'].strip()+'\n').encode()
    def process(command,payload):
        try:
            result=subprocess.run(command,input=payload,capture_output=True,timeout=30)
        except FileNotFoundError:
            raise FinishFailure('crypto_binary_unavailable') from None
        except subprocess.TimeoutExpired:
            raise FinishFailure('crypto_command_timeout') from None
        if result.returncode:
            raise FinishFailure('crypto_command_failed')
        return result.stdout
    progress('derive_age_recipient')
    recipient=process(['age-keygen','-y','/dev/stdin'],key).decode().strip()
    progress('encrypt_history')
    encrypted=process(['age','-r',recipient],bundle)
    progress('independent_key_escrow')
    if not INDEPENDENT_ESCROW.is_file():
        raise FinishFailure('independent_key_escrow_missing')
    independent_recipient=process(['age-keygen','-y',str(INDEPENDENT_ESCROW)],b'').decode().strip()
    matched=hmac.compare_digest(recipient,independent_recipient)
    progress('independent_key_escrow',independent_escrow_recipient_matches_current_lane=matched)
    if not matched:
        raise FinishFailure('independent_key_escrow_mismatch')
    progress('provider_quota')
    if len(encrypted)>1048576 or get_quota(auth)['available_bytes']<len(encrypted):
        raise FinishFailure('backup_size_or_quota_invalid')
    name='root-custody-history-'+datetime.now(timezone.utc).strftime('%Y%m%dT%H%M%SZ')+'-'+uuid.uuid4().hex+'.json.age'
    progress('provider_upload',artifact=name)
    status,_=network(upload+'/forgejo/'+name,'PUT',encrypted,(values['NC_WEBDAV_TOKEN'],''),{'Content-Type':'application/octet-stream','If-None-Match':'*','X-Requested-With':'XMLHttpRequest'})
    progress('provider_upload',upload_http_status=status)
    if status!=201:
        raise FinishFailure('new_artifact_upload_failed')
    progress('provider_download')
    status,fetched=network(HOST+'/remote.php/dav/files/Backup/railiance-backups/forgejo/'+name,'GET',auth=auth)
    progress('provider_download',readback_http_status=status)
    if status!=200:
        raise FinishFailure('provider_download_failed')
    progress('provider_ciphertext_check')
    if hashlib.sha256(fetched).digest()!=hashlib.sha256(encrypted).digest():
        raise FinishFailure('provider_ciphertext_mismatch')
    progress('decrypt_and_compare_history')
    with tempfile.TemporaryDirectory(prefix='root-custody-recovery-') as tmp:
        cipher=Path(tmp)/'history.json.age'
        cipher.write_bytes(fetched)
        cipher.chmod(0o600)
        restored=process(['age','-d','-i',str(INDEPENDENT_ESCROW),str(cipher)],b'')
    if restored!=bundle:
        raise FinishFailure('decrypted_history_mismatch')
    return {'provider':'existing-governed-nextcloud-backup','artifact':name,'upload_http_status':201,'readback_http_status':200,'ciphertext_sha256':hashlib.sha256(encrypted).hexdigest(),'decrypted_history_matches':True,'lane_kv_version':lane['metadata']['version'],'local_historical_rclone_used':False,'independent_escrow_recipient_matches_current_lane':True,'independent_escrow_decryption_verified':True}


STAGES = {
    'share_inventory','share_route_probes', 'startup', 'attended_envelope', 'operator_endpoint', 'canon_pins', 'validator_import',
    'publisher_lock', 'retained_history', 'current_source_read', 'current_baseline_check',
    'backup_lane_read', 'backup_operator_read', 'historical_share_comparison',
    'provider_contract', 'derive_age_recipient', 'encrypt_history', 'independent_key_escrow', 'provider_quota',
    'provider_upload', 'provider_download', 'provider_ciphertext_check', 'decrypt_and_compare_history', 'complete',
}


class FinishFailure(ValueError):
    def __init__(self, code):
        self.code = code


ERROR_CODES = {'share_inventory_invalid','share_probe_invalid','stage_failed', 'attended_envelope_required', 'approved_operator_endpoint_required',
               'canon_pin_mismatch', 'current_backup_lane_incident', 'unexpected_stage',
               'crypto_binary_unavailable','crypto_command_timeout','crypto_command_failed','independent_key_escrow_missing','independent_key_escrow_mismatch',
               'provider_download_failed','provider_ciphertext_mismatch','decrypted_history_mismatch',
               'retained_state_invalid','history_invalid','latest_history_missing',
               'governed_owner_mismatch','current_lane_contract_mismatch','backup_size_or_quota_invalid','new_artifact_upload_failed'}


def main(receipt_reserved=False):
    p=argparse.ArgumentParser()
    p.add_argument('--inspect-share',action='store_true')
    p.add_argument('--state',type=Path,required=True)
    p.add_argument('--net-kingdom',type=Path,required=True)
    p.add_argument('--receipt',type=Path,required=True)
    args=p.parse_args()
    result={'ok':False,'stage':'startup','status':'started',
            'recorded_at':datetime.now(timezone.utc).isoformat()}
    def progress(stage, **details):
        if stage not in STAGES:
            raise FinishFailure('unexpected_stage')
        result['stage']=stage
        for key,value in details.items():
            if key in {'upload_http_status','readback_http_status'} and type(value) is int and 100 <= value <= 599:
                result[key]=value
            elif key=='independent_escrow_recipient_matches_current_lane' and type(value) is bool:
                result[key]=value
            elif key=='artifact' and isinstance(value,str) and value.startswith('root-custody-history-') and value.endswith('.json.age'):
                result[key]=value
        atomic_json(args.receipt,result)
    try:
        if args.receipt.is_symlink():
            return 1
        if not receipt_reserved:
            fd=os.open(args.receipt,os.O_CREAT|os.O_EXCL|os.O_WRONLY,0o600)
            os.close(fd)
        progress('attended_envelope')
        try:
            require_attended()
        except Exception:
            raise FinishFailure('attended_envelope_required') from None
        progress('operator_endpoint')
        if os.getenv('BAO_ADDR')!='http://127.0.0.1:18200':
            raise FinishFailure('approved_operator_endpoint_required')
        progress('canon_pins')
        source=args.net_kingdom/'tools/custody-record/validate.py'
        schema=args.net_kingdom/'canon/schemas/custody-record_v0.1.schema.json'
        if hashlib.sha256(source.read_bytes()).hexdigest()!=VALIDATOR_DIGEST or hashlib.sha256(schema.read_bytes()).hexdigest()!=SCHEMA_DIGEST:
            raise FinishFailure('canon_pin_mismatch')
        progress('validator_import')
        spec=importlib.util.spec_from_file_location('custody_validator',source)
        validator=importlib.util.module_from_spec(spec);spec.loader.exec_module(validator)
        import fcntl
        progress('publisher_lock')
        with (args.state.parent/'publisher.lock').open('a') as lock:
            fcntl.flock(lock,fcntl.LOCK_EX)
            progress('retained_history')
            state,bundle=checked_bundle(args.state,validator)
            bao=Bao()
            progress('current_source_read')
            actual=bao.read('platform/data/custody/net-kingdom/platform-root')
            progress('current_baseline_check')
            check_baseline(actual,state,validator)
            result.update(record_id=RECORD_ID,revision=state['revision'],kv_version=state['kv_version'],
                          digest=state['digest'],current_live_baseline_matches=True)
            progress('backup_lane_read')
            lane=bao.read(LANE)
            result['lane_kv_version']=lane['metadata']['version']
            progress('backup_operator_read')
            operator=bao.read(OPERATOR_PATH)['data']
            progress('historical_share_comparison')
            comparison=historical_config_comparison(Path('/home/worsch/.config/rclone/rclone.conf'),lane['data'])
            result.update(comparison)
            if comparison['historical_share_matches_current_lane'] is True:
                raise FinishFailure('current_backup_lane_incident')
            if args.inspect_share:
                diagnostic=inspect_share(lane,operator,progress=progress)
                result.update(ok=True,status='diagnostic-complete',stage='complete',
                    scope='read-only-current-governed-share-inspection',
                    finished_at=datetime.now(timezone.utc).isoformat(),**diagnostic)
                atomic_json(args.receipt,result)
                return 0
            receipt=roundtrip(bundle,lane,operator,progress=progress)
        result.update(ok=True,status='verified',stage='complete',finished_at=datetime.now(timezone.utc).isoformat(),
           scope='current-owner-read-and-governed-history-provider-roundtrip',
           history_entries=len(json.loads(bundle)['history']),**receipt)
        atomic_json(args.receipt,result)
        return 0
    except FileExistsError:
        # Never change an old success receipt or claim it belongs to this attempt.
        return 1
    except Exception as error:
        result.update(status='failed',finished_at=datetime.now(timezone.utc).isoformat(),error_code=error.code if isinstance(error,FinishFailure) and error.code in ERROR_CODES else 'stage_failed')
        try:
            atomic_json(args.receipt,result)
        except Exception:
            pass
        return 1


if __name__=='__main__':
    raise SystemExit(main())