"""Integrate three reviewed source packages; never deploy or admit credentials."""
from datetime import datetime, timezone
import hashlib
import json
from pathlib import Path
import subprocess

ROOT = Path(__file__).resolve().parent
TARGETS = (
    ('railiance-platform', 'protected-execution-wave5', 'platform-wave5.patch',
     'b4c44a452a1b62d0a2c114e2de60537666a139a387c478c663236b3aacdaadec',
     '5f30ddd90c33e7eb1b9efa1093c7324d83210cf2', 'manifest.json', 'files'),
    ('access-engine', 'access-native-source', 'source-preparation-r2.patch',
     'cee7af8e1e8ee8b63f9d5bc5927a6d89ae6c1169b3ec23f59e0958664fc91dca',
     'ec21518e25df2a58444f19ff3413ce0b83383d3c', 'manifest-r2.json', 'source_files_sha256'),
    ('secrets-engine', 'decision-native-preparation', 'implementation-r1.patch',
     '316daaba4afa309b2f13acf995f781d9fae1ea84e12837a8b494e31b8489dd46',
     'ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225', 'integration-manifest-r1.json', 'files'),
)


def digest(path):
    return hashlib.sha256(path.read_bytes()).hexdigest() if path.exists() else None


def main():
    prepared = []
    for repo, part, filename, patch_hash, head, manifest_name, key in TARGETS:
        owner, folder = Path('/home/worsch') / repo, ROOT / part
        assert not (folder / 'canonical-integration.json').exists(), 'already integrated'
        patch = folder / filename
        assert digest(patch) == patch_hash, repo
        assert subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=owner, text=True).strip() == head, repo
        files = json.loads((folder / manifest_name).read_text())[key]
        assert not subprocess.check_output(['git', 'diff', 'HEAD', '--', *files], cwd=owner), repo
        after = {}
        before = {}
        for name, expected in files.items():
            assert not Path(name).is_absolute() and '..' not in Path(name).parts
            tracked = subprocess.run(['git', 'ls-files', '--error-unmatch', name], cwd=owner, capture_output=True).returncode == 0
            assert tracked or not (owner / name).exists(), name
            before[name] = digest(owner / name)
            if isinstance(expected, dict):
                assert before[name] == expected['before_sha256'], name
                expected = expected['after_sha256']
            after[name] = expected
        subprocess.run(['git', 'apply', '--check', str(patch)], cwd=owner, check=True)
        prepared.append((repo, owner, folder, patch, patch_hash, head, before, after))
    for repo, owner, folder, patch, patch_hash, head, before, after in prepared:
        assert subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=owner, text=True).strip() == head
        assert all(digest(owner / name) == value for name, value in before.items())
        subprocess.run(['git', 'apply', str(patch)], cwd=owner, check=True)
        assert all(digest(owner / name) == value for name, value in after.items())
        receipt = {'repo': repo, 'base_commit': head, 'patch_sha256': 'sha256:' + patch_hash,
                   'integrated_at': datetime.now(timezone.utc).isoformat(),
                   'files_sha256': {name: 'sha256:' + value for name, value in after.items()},
                   'source_integrated': True, 'committed': False, 'published': False,
                   'native_accepted': False}
        (folder / 'canonical-integration.json').write_text(json.dumps(receipt, indent=2) + '\n')
        print(f'{repo}: {len(after)} reviewed source files integrated')


if __name__ == '__main__':
    main()