#!/usr/bin/env python3
"""Partial read-only identity evidence. Never an admission authority."""
import datetime
import hashlib
import json
import os
from pathlib import Path
import sys


def evaluate(expected_uid, expected_machine, actual_uid, machine_digest):
    return {
        "identity_matches": actual_uid == expected_uid
        and actual_uid not in (0, 1000)
        and len(expected_machine) == 64
        and expected_machine == machine_digest,
        "actual_uid": actual_uid,
        "assignment_admitted": False,
        "scope": "partial_process_identity_only",
    }


def main():
    try:
        expected_uid = int(sys.argv[1])
        expected_machine = sys.argv[2]
        machine = hashlib.sha256(Path('/etc/machine-id').read_bytes()).hexdigest()
        result = evaluate(expected_uid, expected_machine, os.geteuid(), machine)
        result['capture_utc'] = datetime.datetime.now(datetime.timezone.utc).isoformat()
    except Exception:
        result = {'identity_matches': False, 'assignment_admitted': False,
                  'reason': 'identity_probe_refused'}
    print(json.dumps(result, sort_keys=True))
    return 0 if result['identity_matches'] else 1


if __name__ == '__main__':
    sys.exit(main())