#!/usr/bin/env python3
"""Silent contained callback update; preserve the existing administrator role."""
import json
import subprocess
import sys

ROLE = 'auth/netkingdom/role/platform-admin'
CALLBACK = 'http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback'


def read_role():
    result = subprocess.run(['bao', 'read', '-format=json', ROLE],
                            capture_output=True, check=True, timeout=30)
    role = json.loads(result.stdout)['data']
    if (role.get('role_type') != 'oidc'
            or 'platform-admin' not in role.get('token_policies', role.get('policies', []))
            or not isinstance(role.get('allowed_redirect_uris'), list)
            or not all(isinstance(uri, str) for uri in role['allowed_redirect_uris'])):
        raise ValueError('unexpected role')
    return role


def update(read=read_role, write=None):
    original = read()
    if CALLBACK in original['allowed_redirect_uris']:
        return False
    desired = dict(original, allowed_redirect_uris=original['allowed_redirect_uris'] + [CALLBACK])
    if read() != original:
        raise ValueError('role changed before write')
    # The endpoint has no CAS: this detects observed drift, not an atomic lock.
    if write is None:
        subprocess.run(['bao', 'write', ROLE, '-'], input=json.dumps(desired).encode(),
                       capture_output=True, check=True, timeout=30)
    else:
        write(desired)
    if read() != desired:
        raise ValueError('role readback differs')
    return True


if __name__ == '__main__':
    try:
        if sys.argv[1:] == ['--check-only']:
            sys.exit(0 if CALLBACK in read_role()['allowed_redirect_uris'] else 3)
        if sys.argv[1:]:
            sys.exit(2)
        update()
    except Exception:
        sys.exit(1)