"""Read-only, silent owner preflight inside Warden's attended login envelope.

Queries only token capabilities for the exact two reviewed CCR targets. Reads
no secret data, applies no metadata, and does not record an approval. Warden
owns the temporary token helper and self-revokes after this command returns.
"""
import argparse
import json
import os
import subprocess
from datetime import datetime, timezone
from pathlib import Path

PATHS = [
    'sys/policies/acl/workload-kv-read-keycape-secrets-engine-approval',
    'sys/policies/acl/workload-kv-read-keycape-approval-engine-operator',
    'auth/kubernetes/role/external-secrets-keycape-secrets-engine-approval',
    'auth/kubernetes/role/external-secrets-keycape-approval-engine-operator',
    'platform/data/workloads/secrets-engine/approval-client',
    'platform/data/workloads/approval-engine/operator-client',
]
ALLOWED = {'create', 'read', 'update', 'patch', 'delete', 'list', 'sudo', 'deny', 'root'}


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--receipt", type=Path, required=True)
    args = parser.parse_args()
    receipt = {'observed_at': datetime.now(timezone.utc).isoformat(),
               'requests': ['CCR-2026-0017', 'CCR-2026-0018'],
               'operation': 'capabilities-self only', 'credential_data_read': False,
               'metadata_applied': False, 'custody_activated': False,
               'upstream_issuer_proven': False}
    caps = {}
    for path in PATHS:
        # This installed CLI accepts one PATH. Supplying several positional
        # arguments selects a different TOKEN/PATH form or refuses the call.
        result = subprocess.run(['bao', 'token', 'capabilities', '-format=json', path],
                                capture_output=True, text=True, timeout=20)
        if result.returncode:
            receipt['status'] = 'capability-query-failed'
            break
        payload = json.loads(result.stdout)
        values = payload if isinstance(payload, list) else payload.get('capabilities')
        if not isinstance(values, list) or any(v not in ALLOWED for v in values):
            raise ValueError('unexpected capability response shape')
        caps[path] = sorted(set(values))
    else:
        receipt['status'] = 'observed'
        receipt['capabilities'] = caps
        receipt['required_metadata_capabilities_present'] = all(
            {'create', 'update'}.issubset(values) for values in caps.values())
    receipt['paths_verified'] = len(caps)
    fd = os.open(args.receipt, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    with os.fdopen(fd, 'w') as stream:
        json.dump(receipt, stream, indent=2)
        stream.write('\n')


if __name__ == '__main__':
    try:
        main()
    except Exception:
        raise SystemExit(1) from None