"""Draft-only offline exact-path lane scaffolding; no execution surface."""
from __future__ import annotations

from copy import deepcopy
from datetime import date
import hashlib
import json
from pathlib import Path
import re
import sys
import tempfile

import jsonschema
import yaml

REPO_DIR = Path(__file__).resolve().parents[1]
MAX_INPUT_BYTES = 128 * 1024
SECRET_MARKERS = ('AGE-SECRET-KEY-1', '-----BEGIN', 'hvs.', 'hvb.', 'hvc.', 'ghp_', 'github_pat_', 'npm_', 'BAO_TOKEN=', 'VAULT_TOKEN=', 'OPENBAO_ROOT_TOKEN=')


class UniqueLoader(yaml.SafeLoader):
    pass


def unique_mapping(loader, node):
    result = {}
    for key_node, value_node in node.value:
        key = loader.construct_object(key_node)
        if not isinstance(key, str) or key in result:
            raise ValueError('Invalid or duplicate metadata key')
        result[key] = loader.construct_object(value_node)
    return result


UniqueLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, unique_mapping)


def read_metadata(path):
    with Path(path).open('rb') as stream:
        raw = stream.read(MAX_INPUT_BYTES + 1)
    if len(raw) > MAX_INPUT_BYTES:
        raise ValueError('Metadata input exceeds size limit')
    text = raw.decode('utf-8')
    if any(marker in text for marker in SECRET_MARKERS) or re.search(r'(?<![A-Za-z])sk-[A-Za-z0-9]', text):
        raise ValueError('Metadata input contains rejected secret material')
    try:
        data = yaml.load(text, Loader=UniqueLoader)
        canonical = json.dumps(data, allow_nan=False)
        if any(marker in canonical for marker in SECRET_MARKERS) or re.search(r"(?<![A-Za-z])sk-[A-Za-z0-9]", canonical):
            raise ValueError("Rejected parsed secret material")
    except (yaml.YAMLError, TypeError, RecursionError, ValueError) as exc:
        raise ValueError('Invalid metadata document') from None
    return data, hashlib.sha256(raw).hexdigest()


def validate_request(data):
    schema = json.loads((REPO_DIR / 'schemas/catalog-lane-scaffold.schema.json').read_text())
    if not jsonschema.Draft202012Validator(schema).is_valid(data):
        raise ValueError('Request does not match closed platform scaffold schema v1')
    def text_values(value):
        if isinstance(value, dict):
            return [item for nested in value.values() for item in text_values(nested)]
        if isinstance(value, list):
            return [item for nested in value for item in text_values(nested)]
        return [value] if isinstance(value, str) else []
    if any(any(ord(char) < 32 for char in value) for value in text_values(data)):
        raise ValueError('Control characters are not supported in scaffold metadata')
    date.fromisoformat(data['date'])
    bao = data['openbao']
    if not bao['kv_path'].startswith(bao['mount'] + '/'):
        raise ValueError('KV path must use the explicitly declared mount')
    auth = bao['auth']
    units = {'s': 1, 'm': 60, 'h': 3600}
    ttl = auth['ttl']
    if int(ttl[:-1]) * units[ttl[-1]] > 900:
        raise ValueError('Prospective Kubernetes token TTL exceeds fifteen minutes')
    eso = data['eso']
    if len(auth['service_account_names']) != 1 or len(auth['service_account_namespaces']) != 1:
        raise ValueError('One explicit ESO auth identity is supported')
    keys = [item['secret_key'] for item in eso['data']]
    properties = [item['property'] for item in eso['data']]
    if len(set(keys)) != len(keys) or len(set(properties)) != len(properties) or set(properties) != set(bao['fields']):
        raise ValueError('ESO mappings must cover the explicit field set exactly once')


def verify_catalog_join(request, catalog):
    # Warden validates its own full input; platform checks only the shared seam.
    if not isinstance(catalog, dict):
        raise ValueError('Catalog pointer manifest must be an object')
    for field in ('schema_version', 'lane_id', 'title', 'consumer_repo', 'owner_repo'):
        if catalog.get(field) != request[field]:
            raise ValueError('Cross-owner fixture identity mismatch')
    if catalog.get('risk') != request['risk']['classification']:
        raise ValueError('Cross-owner risk mismatch')
    if catalog.get('canon_ref') != 'railiance-platform:credential-change-requests/' + request['ccr_id'] + '.yaml':
        raise ValueError('Catalog CCR destination pointer mismatch')
    ref = catalog.get('platform_request_ref')
    if not isinstance(ref, str) or not re.fullmatch(r'railiance-platform:[a-zA-Z0-9_./-]+', ref) or '..' in ref:
        raise ValueError('Catalog needs a non-secret owner request pointer')


def render_artifacts(data, policy_renderer, auth_renderer, request_digest, catalog_digest=None):
    validate_request(data)
    data = deepcopy(data)
    bao = data['openbao']
    auth = bao['auth']
    lane = data['lane_id']
    policy_file = 'openbao/policies/' + bao['policy_name'] + '.hcl'
    ccr = {'id': data['ccr_id'], 'kind': 'credential-change-request', 'schema_version': 1,
           'request_type': 'workload-kv-read', 'title': data['title'], 'status': 'proposed',
           'created': data['date'], 'updated': data['date'], 'requester': data['requester'],
           'review': {'required': True, 'required_approvers': data['review_approvers'], 'comments': []},
           'target': data['target'],
           'openbao': {'mount': bao['mount'], 'kv_path': bao['kv_path'], 'fields': bao['fields'],
                       'policy_name': bao['policy_name'], 'policy_file': policy_file, 'metadata_read': False,
                       'auth': {'method': 'kubernetes', 'mount': auth['mount'], 'role': auth['role'],
                                'audience': auth['audience'], 'ttl': auth['ttl'],
                                'token_max_ttl': auth['ttl'], 'token_explicit_max_ttl': auth['ttl'],
                                'token_no_default_policy': True, 'policies': [bao['policy_name']],
                                'bound_claims': {'service_account_names': auth['service_account_names'],
                                                 'service_account_namespaces': auth['service_account_namespaces']},
                                'bound_claims_confirmed': False}},
           'access_frontdoor': {'type': 'external-secrets', 'catalog_id': lane,
                                'readiness': 'pending-review', 'resolvable': False},
           'risk': data['risk'],
           'verification': {'positive': ['Owner-reviewed native exact identity and exact path proof required'],
                            'negative': ['Owner-reviewed wrong identity, sibling GET and parent LIST denials required'],
                            'activation_conditions': ['Exact CCR approval, confirmed identity, attended custody and native receipt acceptance required']},
           'lifecycle': {'deactivate': 'Owner-reviewed delivery withdrawal and token revocation; exact rollback receipt required',
                         'rotate': 'Separate version-guarded owner approval and contained value delivery required',
                         'compromised': 'Owner incident process; no automatic read, reseed or cleanup'},
           'scaffold': {'draft_only': True, 'consumer_repo': data['consumer_repo'],
                        'owner_repo': data['owner_repo'], 'request_sha256': request_digest,
                        'catalog_request_sha256': catalog_digest}}
    annotation = {'railiance.io/credential-change': data['ccr_id'], 'railiance.io/admission': 'pending-review'}
    eso = data['eso']
    store = {'apiVersion': 'external-secrets.io/v1', 'kind': 'ClusterSecretStore',
             'metadata': {'name': eso['store_name'], 'annotations': deepcopy(annotation)},
             'spec': {'provider': {'vault': {'server': eso['server'], 'path': bao['mount'], 'version': 'v2',
                                           'auth': {'kubernetes': {'mountPath': auth['mount'], 'role': auth['role'],
                                                                  'audiences': [auth['audience']],
                                                                  'serviceAccountRef': {'name': auth['service_account_names'][0],
                                                                                        'namespace': auth['service_account_namespaces'][0]}}}}},
                      'conditions': [{'namespaces': [eso['namespace']]}]}}
    secret = {'apiVersion': 'external-secrets.io/v1', 'kind': 'ExternalSecret',
              'metadata': {'name': eso['external_secret_name'], 'namespace': eso['namespace'], 'annotations': deepcopy(annotation)},
              'spec': {'refreshInterval': eso['refresh_interval'],
                       'secretStoreRef': {'kind': 'ClusterSecretStore', 'name': eso['store_name']},
                       'target': {'name': eso['secret_name'], 'creationPolicy': 'Owner', 'deletionPolicy': 'Retain',
                                  'template': {'metadata': {'annotations': deepcopy(annotation)}}},
                       'data': [{'secretKey': item['secret_key'],
                                 'remoteRef': {'key': bao['kv_path'][len(bao['mount']) + 1:], 'property': item['property']}}
                                for item in eso['data']]}}
    evidence = {'schema_version': 1, 'lane_id': lane, 'ccr_id': data['ccr_id'], 'status': 'not-executed',
                'draft_only': True, 'verified': False, 'request_sha256': request_digest,
                'required_owner_checks': ['Exact revision/digest and required owner reviews',
                                          'Identity/auth claims confirmed separately; no inferred workload identity',
                                          'Metadata/capability readback through reviewed output-suppressing owner tool',
                                          'No Secret bodies, values or raw subprocess errors in evidence',
                                          'Native scoped positive/negative, cleanup/revocation and rollback receipts after approval']}
    artifacts = {'credential-change-requests/' + data['ccr_id'] + '.yaml': yaml.safe_dump(ccr, sort_keys=False),
                 policy_file: '# DRAFT ONLY: exact CCR review and confirmed identity required.\n' + policy_renderer(ccr),
                 'openbao/auth/' + auth['role'] + '.draft.json': json.dumps({'draft_only': True, 'status': 'proposed',
                                                                           'bound_claims_confirmed': False,
                                                                           'auth_payload': auth_renderer(ccr)}, indent=2) + '\n',
                 'manifests/' + lane + '.draft.yaml': '# DRAFT REVIEW ARTIFACT. Do not apply. No custody/admission supplied.\n' + yaml.safe_dump_all([store, secret], sort_keys=False),
                 'docs/evidence/' + lane + '.checklist.json': json.dumps(evidence, indent=2) + '\n',
                 'README.md': 'Draft-only review bundle. No admission, approval, confirmed identity, credential value or executed receipt.\n'
                              'Review the exact request digest and owner destinations before promoting any file.\n'
                              'ESO target metadata is explicit to contain source last-applied annotations.\n'}
    return artifacts


def scaffold(input_path, output_dir, policy_renderer, auth_renderer, catalog_manifest=None):
    data, digest = read_metadata(input_path)
    catalog_digest = None
    if catalog_manifest is not None:
        catalog, catalog_digest = read_metadata(catalog_manifest)
        validate_request(data)
        verify_catalog_join(data, catalog)
    artifacts = render_artifacts(data, policy_renderer, auth_renderer, digest, catalog_digest)
    output = Path(output_dir).absolute()
    if output.is_symlink() or output.exists() or output.resolve().is_relative_to(REPO_DIR.resolve()):
        raise ValueError('Output must be a new staging directory outside the owner repository')
    if any((p / '.git').exists() for p in output.resolve().parents if p != Path(tempfile.gettempdir()).resolve()):
        raise ValueError('Output staging must not be inside a repository')
    output.mkdir(mode=0o700, parents=False)
    for relative, content in artifacts.items():
        path = output / relative
        path.parent.mkdir(parents=True, exist_ok=True)
        with path.open('x', encoding='utf-8') as stream:
            stream.write(content)
    return artifacts


def command_scaffold(args, policy_renderer, auth_renderer):
    try:
        artifacts = scaffold(args.input, args.output_dir, policy_renderer, auth_renderer, args.catalog_manifest)
    except (ValueError, OSError, UnicodeError, RecursionError):
        print('Scaffold refused: invalid metadata, mismatched owner pointers, or unsafe staging output.', file=sys.stderr)
        return 2
    print('Prepared ' + str(len(artifacts)) + ' draft review artifacts; nothing admitted or executed.')
    return 0