#!/usr/bin/env python3
"""Silent attended Grafana API probe through a fixed localhost tunnel."""
import argparse
import base64
import json
import os
import urllib.error
import urllib.request

from state_hub_preflight_lane import LaneError, bao, data


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--receipt', required=True)
    args = parser.parse_args()
    fd = os.open(args.receipt, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
    receipt = {'schema': 'rapp-telemetry.access.v1', 'status': 'failed'}
    try:
        policies = data(bao(['token', 'lookup', '-format=json']))['data']['policies']
        if 'platform-admin' not in policies or 'root' in policies:
            raise LaneError('attended_platform_admin_required')
        opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
        def request(path, headers=None):
            req = urllib.request.Request('http://127.0.0.1:13001' + path, headers=headers or {})
            try:
                with opener.open(req, timeout=10) as response:
                    return response.status, json.load(response)
            except urllib.error.HTTPError as error:
                return error.code, None
        for label, headers in [('anonymous_denied', {}), ('forged_proxy_denied', {
                'X-WEBAUTH-USER': 'admin', 'Remote-User': 'admin', 'Remote-Groups': 'admins'})]:
            if request('/api/user', headers)[0] != 401:
                raise LaneError('negative_access_failed')
            receipt[label] = True
        native = data(bao(['read', '-format=json', 'platform/data/workloads/telemetry/grafana-admin']))['data']['data']
        credential = base64.b64encode((native['ADMIN_USERNAME'] + ':' + native['ADMIN_PASSWORD']).encode()).decode()
        headers = {'Authorization': 'Basic ' + credential}
        status, user = request('/api/user', headers)
        if status != 200 or user.get('login') != 'admin' or not user.get('isGrafanaAdmin'):
            raise LaneError('positive_access_failed')
        receipt['native_admin_authenticated'] = True
        status, sources = request('/api/datasources', headers)
        if status != 200 or not any(s['type'] == 'prometheus' for s in sources):
            raise LaneError('datasource_missing')
        receipt['prometheus_datasource_present'] = True
        status, dashboards = request('/api/search?type=dash-db', headers)
        if status != 200 or not dashboards:
            raise LaneError('dashboards_missing')
        receipt.update(status='verified', dashboard_count=len(dashboards))
    except Exception:
        receipt['error'] = 'access_verification_failed'
    finally:
        with os.fdopen(fd, 'w') as output:
            json.dump(receipt, output, indent=2)
    return 0 if receipt['status'] == 'verified' else 1


if __name__ == '__main__':
    raise SystemExit(main())