#!/usr/bin/env python3
"""Attended owner expiration of reviewed essentials candidates; no workload deletion grant."""
import argparse
import base64
import json
import hashlib
import fcntl
import os
from pathlib import Path
import urllib.request
from backup_retention_plan import NAME, RESERVE
from migrate_nextcloud_backup_account import HOST, OPERATOR_PATH, NoRedirect, quota, require
from state_hub_preflight_lane import bao,data


def validate(plan, restore):
    require(plan.get('schema')=='platform.essentials-retention-plan.v1' and plan.get('status')=='ready','ready_plan_required')
    keep=set(plan['keep']); protected=set(plan['protected'])
    require(bool(protected) and protected<=keep,'protected_anchor_required')
    require(restore.get('status')=='restored_essentials' and restore.get('cleanup') is True
            and restore.get('offsite_artifact') in protected,'verified_recovery_anchor_required')
    candidates=plan['delete_candidates']; names=[item['name'] for item in candidates]
    require(len(names)==len(set(names)) and not keep.intersection(names),'ambiguous_expiration_plan')
    for name in list(keep)+names: require(NAME.fullmatch(name) is not None,'managed_essentials_name_required')
    for item in candidates:
        etag=item['etag']
        require(etag.startswith('"') and etag.endswith('"') and not any(c in etag for c in '\r\n'),'strong_etag_required')
    return candidates


def execute(plan,restore,receipt):
    candidates=validate(plan,restore)
    if not candidates:
        receipt['status']='no_expiration_needed';return
    entry=data(bao(['read','-format=json',OPERATOR_PATH]))['data']['data']
    require(entry['BACKUP_USERNAME']=='Backup','backup_owner_required')
    auth=(entry['BACKUP_USERNAME'],entry['BACKUP_PASSWORD'])
    headers={'Authorization':'Basic '+base64.b64encode((auth[0]+':'+auth[1]).encode()).decode()}
    opener=urllib.request.build_opener(NoRedirect())
    root=HOST+'/remote.php/dav/files/Backup/railiance-backups/forgejo/'
    receipt['quota_before']=quota(auth)
    require(receipt['quota_before']['available_bytes']>=RESERVE,'headroom_recheck_failed')
    # Verify every retained recovery point is present before any expiration.
    for name in plan['keep']:
        with opener.open(urllib.request.Request(root+name,method='HEAD',headers=headers),timeout=60) as response:
            require(response.status==200 and int(response.headers['Content-Length'])>0,'retained_point_missing')
    # Revalidate the exact recovered ciphertext, not merely a nonempty name.
    with opener.open(urllib.request.Request(root+restore['offsite_artifact'],headers=headers),timeout=60) as response:
        require(0<int(response.headers['Content-Length'])<=600*1024**2,'anchor_size_outside_budget')
        digest=hashlib.sha256()
        while block:=response.read(1024*1024): digest.update(block)
    require(digest.hexdigest()==restore['ciphertext_sha256'],'recovery_anchor_changed')
    receipt['removed']=[]
    for item in candidates:
        with opener.open(urllib.request.Request(root+item['name'],method='HEAD',headers=headers),timeout=60) as response:
            require(response.headers.get('ETag')==item['etag'] and int(response.headers['Content-Length'])==item['bytes'],'candidate_changed')
        conditional=dict(headers,**{'If-Match':item['etag']})
        with opener.open(urllib.request.Request(root+item['name'],method='DELETE',headers=conditional),timeout=60) as response:
            require(response.status==204,'conditional_expiration_failed')
        receipt['removed'].append(item['name'])
    receipt.update(status='expired',quota_after=quota(auth))


def main():
    p=argparse.ArgumentParser(description=__doc__)
    p.add_argument('--plan',required=True,type=Path);p.add_argument('--restore-receipt',required=True,type=Path)
    p.add_argument('--receipt',required=True);p.add_argument('--apply',action='store_true')
    args=p.parse_args();result={'schema':'platform.essentials-retention-execution.v1','status':'failed'}
    fd=os.open(args.receipt,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
    try:
        plan=json.loads(args.plan.read_text());restore=json.loads(args.restore_receipt.read_text())
        candidates=validate(plan,restore)
        if args.apply:
            lock=os.open('/tmp/railiance-platform-essentials-retention-'+str(os.getuid())+'.lock',
                         os.O_WRONLY|os.O_CREAT|os.O_NOFOLLOW,0o600)
            try:
                require(os.fstat(lock).st_uid==os.getuid(),'retention_lock_owner_mismatch')
                fcntl.flock(lock,fcntl.LOCK_EX|fcntl.LOCK_NB)
                execute(plan,restore,result)
            finally: os.close(lock)
        else: result.update(status='preview',candidate_count=len(candidates),provider_mutations=False)
    except Exception: result['error']='bounded_essentials_expiration_refused'
    finally:
        with os.fdopen(fd,'w') as output: json.dump(result,output,indent=2)
    return int(result['status']=='failed')
if __name__=='__main__': raise SystemExit(main())