#!/usr/bin/env python3
"""Exact reviewed renewal metadata; owner-admin operation, not generic KV-read delegation."""
import argparse,json,os
from pathlib import Path
from keycape_factor_metadata import call,normalized,policy_text
ROOT=Path(__file__).resolve().parents[1]
NAME="keycape-factor-renewer"
ROLE={"bound_service_account_names":[NAME],"bound_service_account_namespaces":["sso"],"audience":"openbao","token_policies":[NAME],"token_ttl":300,"token_max_ttl":300,"token_no_default_policy":True}
def execute():
 policy=(ROOT/"openbao/policies"/(NAME+".hcl")).read_text()
 existing=call("policy","list","-format=json")
 if NAME in existing:
  if normalized(policy_text(call("policy","read","-format=json",NAME)))!=normalized(policy):raise RuntimeError("existing renewal policy differs")
 else:call("write","-format=json","sys/policies/acl/"+NAME,"-",payload={"policy":policy})
 roles=call("list","-format=json","auth/kubernetes/role")
 names=roles if isinstance(roles,list) else roles.get("data",{}).get("keys",[])
 path="auth/kubernetes/role/"+NAME
 if NAME in names:
  data=call("read","-format=json",path)["data"]
  if any(data.get(k)!=v for k,v in ROLE.items()):raise RuntimeError("existing renewal role differs")
 else:call("write","-format=json",path,"-",payload=ROLE)
 data=call("read","-format=json",path)["data"]
 if any(data.get(k)!=v for k,v in ROLE.items()):raise RuntimeError("renewal role readback failed")
 if normalized(policy_text(call("policy","read","-format=json",NAME)))!=normalized(policy):raise RuntimeError("renewal policy readback failed")
 return {"success":True,"policy":NAME,"role":path,"token_max_ttl":300,"secret_values_read":False,"secret_values_written":False}
def main():
 p=argparse.ArgumentParser();p.add_argument("--receipt",type=Path,required=True);a=p.parse_args()
 if any(os.environ.get(k) for k in ["VAULT_TOKEN","BAO_TOKEN","OPENBAO_TOKEN"]):return 2
 fd=os.open(a.receipt,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600);result={"success":False}
 try:result=execute();return 0
 except RuntimeError as e:result["failure"]=str(e);return 1
 except Exception as e:result["failure_type"]=type(e).__name__;return 1
 finally:os.write(fd,json.dumps(result,indent=2).encode());os.close(fd)
if __name__=="__main__":raise SystemExit(main())