"""Silent exact-reader metadata preflight under the Warden login envelope."""
import json
import os
from pathlib import Path
import subprocess
from datetime import datetime, timezone

POLICY = 'workload-kv-read-secrets-engine-approval-client'
DATA = 'platform/data/workloads/secrets-engine/approval-client'
META = 'platform/metadata/workloads/secrets-engine/approval-client'
EXPECTED = {
    DATA: ['read'], META: ['read'],
    'platform/data/workloads/approval-engine/operator-client': ['deny'],
    'platform/metadata/workloads/secrets-engine': ['deny'],
    'platform/metadata/workloads': ['deny'],
    'platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets': ['deny'],
    'sys/policies/acl/' + POLICY: ['deny'],
    'auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read': ['deny'],
}
RECEIPT = Path('/home/worsch/railiance-platform/docs/evidence/2026-09-14-ccr0019-reader-preflight.json')

def validate_identity(identity):
    policies = set(identity.get('policies', [])) | set(identity.get('identity_policies', []))
    if POLICY not in policies or policies - {POLICY, 'default'}:
        raise ValueError('unexpected_effective_policies')
    if not identity.get('entity_id') or not 0 < identity.get('ttl', 0) <= 900:
        raise ValueError('unbounded_or_unidentified_reader')

def bao(*args):
    result = subprocess.run(['bao', *args], capture_output=True, text=True, timeout=30)
    if result.returncode:
        raise ValueError('metadata_request_failed')
    return json.loads(result.stdout)

def main():
    receipt = {'observed_at': datetime.now(timezone.utc).isoformat(),
               'ccr_id': 'CCR-2026-0019', 'secret_values_read': False,
               'status': 'refused', 'checks': {}}
    try:
        if Path.home().parent.name != '.warden-attended-login' or os.getenv('BAO_TOKEN') or os.getenv('VAULT_TOKEN'):
            raise ValueError('attended_envelope_required')
        identity = bao('token', 'lookup', '-format=json')['data']
        validate_identity(identity)
        receipt['identity_policy_scope_verified'] = True
        for path, expected in EXPECTED.items():
            values = bao('token', 'capabilities', '-format=json', path)
            if sorted(values) != expected:
                raise ValueError('capabilities_mismatch')
            receipt['checks'][path] = expected
        receipt['status'] = 'passed'
    except Exception as exc:
        code = str(exc)
        receipt['failure'] = code if code in {'attended_envelope_required', 'unexpected_effective_policies', 'unbounded_or_unidentified_reader', 'metadata_request_failed', 'capabilities_mismatch'} else 'preflight_failed'
        raise
    finally:
        RECEIPT.write_text(json.dumps(receipt, indent=2) + '\n')

if __name__ == '__main__':
    try:
        main()
    except Exception:
        raise SystemExit(1) from None