"""Silent attended CCR-2026-0019 metadata apply and readback; no KV reads."""
import json
import os
from pathlib import Path
import subprocess
from datetime import datetime, timezone

REPO = Path('/home/worsch/railiance-platform')
ROLE = 'secrets-engine-approval-client-workload-kv-read'
POLICY = 'workload-kv-read-secrets-engine-approval-client'
RECEIPT = REPO / 'docs/evidence/2026-09-14-ccr0019-operator-binding.json'

def run(*args):
    result = subprocess.run(args, cwd=REPO, capture_output=True, text=True, timeout=60)
    if result.returncode:
        raise RuntimeError('command_failed')
    return result.stdout

def main():
    if Path.home().parent.name != '.warden-attended-login' or os.getenv('BAO_TOKEN') or os.getenv('VAULT_TOKEN'):
        raise RuntimeError('attended_envelope_required')
    identity = json.loads(run('bao', 'token', 'lookup', '-format=json'))['data']
    if 'platform-admin' not in identity['policies'] or 'root' in identity['policies']:
        raise RuntimeError('platform_admin_required')
    run('python3', 'scripts/credential-change.py', 'applier-apply', 'CCR-2026-0019',
        '--actor', 'operator via attended Warden platform-admin OIDC',
        '--confirm', 'DELEGATED APPLY CCR-2026-0019', '--quiet')
    response = json.loads(run('bao', 'read', '-format=json', 'auth/netkingdom/role/' + ROLE))
    role = response['data']
    expected = {
        'bound_claims': {'groups': ['net-kingdom-admins']},
        'role_type': 'oidc', 'user_claim': 'sub', 'groups_claim': 'groups',
    }
    for key, value in expected.items():
        if role.get(key) != value:
            raise RuntimeError('role_readback_mismatch')
    if role.get('token_policies', role.get('policies')) != [POLICY] or role.get('token_ttl', role.get('ttl')) != 900:
        raise RuntimeError('policy_or_ttl_mismatch')
    actual = run('bao', 'policy', 'read', POLICY)
    source = (REPO / 'openbao/policies' / (POLICY + '.hcl')).read_text()
    if actual.split() != source.split():
        raise RuntimeError('policy_readback_mismatch')
    receipt = {
        'observed_at': datetime.now(timezone.utc).isoformat(), 'ccr_id': 'CCR-2026-0019',
        'status': 'metadata_applied_and_readback_verified', 'role': ROLE,
        'group': 'net-kingdom-admins', 'policy': POLICY, 'ttl_seconds': 900,
        'role_request_id': response.get('request_id'),
        'attended_platform_admin': True, 'secret_values_read': False,
        'frontdoor_activated': False, 'positive_negative_delivery_verified': False,
        'session_revocation': 'performed separately by enclosing Warden command',
    }
    RECEIPT.write_text(json.dumps(receipt, indent=2) + '\n')

if __name__ == '__main__':
    try:
        main()
    except Exception:
        raise SystemExit(1) from None