#!/usr/bin/env python3
"""Keep Warden containment; supply a scoped browser launcher when WSL lacks one."""
import os
from pathlib import Path
import shutil
import sys


LANES = (
    'openbao-platform-admin-login',
    'informed-decision-sitting-requester-login',
)


def reviewed_command(args):
    if args and args[0] == '--':
        args = args[1:]
    if not args:
        raise SystemExit('A reviewed silent owner command is required')
    command = Path(args[0]).expanduser()
    if not command.is_absolute():
        command = Path.cwd() / command
    try:
        command = command.resolve(strict=True)
    except OSError:
        raise SystemExit('Reviewed owner command is missing')
    if not os.access(command, os.X_OK):
        raise SystemExit('Reviewed owner command is not executable')
    return [str(command), *args[1:]]


def parse_argv(argv):
    args = list(argv)
    lane = 'openbao-platform-admin-login'
    if args[:1] == ['--lane']:
        if len(args) < 2:
            raise SystemExit('lane required')
        lane, args = args[1], args[2:]
    elif args and args[0].startswith('--lane='):
        lane, args = args[0].split('=', 1)[1], args[1:]
    if lane not in LANES:
        raise SystemExit('unsupported attended login lane')
    return lane, reviewed_command(args)


TUNNEL = 'http://127.0.0.1:18200'


def contained_env():
    env = os.environ.copy()
    env['BAO_ADDR'] = TUNNEL
    env['VAULT_ADDR'] = TUNNEL
    env.pop('BAO_TOKEN', None)
    env.pop('VAULT_TOKEN', None)
    env['WARDEN_ROUTING_CATALOG'] = '/home/worsch/ops-warden/registry/routing/catalog.yaml'
    if not any(shutil.which(x) for x in ('xdg-open', 'x-www-browser', 'www-browser')):
        if not Path('/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe').is_file():
            raise SystemExit('No supported attended browser launcher is available')
        env['PATH'] = str(Path(__file__).resolve().parent / 'operator-browser') + os.pathsep + env.get('PATH', '')
    return env


def main():
    lane, args = parse_argv(sys.argv[1:])
    os.execvpe('warden', ['warden', 'access', lane, '--exec', '--', *args], contained_env())


if __name__ == '__main__':
    main()