"""Host-side deployment checks and secret-safe Compose execution (Python stdlib only)."""
import argparse
from datetime import datetime, timezone
import hashlib
import json
import os
from pathlib import Path
import re
import stat
import subprocess


REQUIRED = (
    'POSTGRES_DB', 'POSTGRES_USER', 'POSTGRES_PASSWORD',
    'INITIAL_ADMIN_USERNAME', 'INITIAL_ADMIN_PASSWORD', 'INITIAL_ADMIN_EMAIL',
    'GITEA_URL', 'GITEA_TOKEN', 'GITEA_OWNER', 'GITEA_REPO',
    'PUSH_ENABLED', 'FIREBASE_PROJECT_ID', 'FIREBASE_SERVICE_ACCOUNT_FILE', 'COOKIE_SECURE',
)
REPO_ROOT = Path(__file__).resolve().parent.parent


class PreprodError(Exception):
    """Only fixed messages or variable names; never external diagnostic text."""


def private_file(path, repo_root, label):
    try:
        if not path.is_absolute() or path.resolve().is_relative_to(repo_root.resolve()):
            raise PreprodError(label + ' must be an absolute path outside the repository')
        info = path.lstat()
        if not stat.S_ISREG(info.st_mode):
            raise PreprodError(label + ' must be a regular file, not a symlink')
        if info.st_uid != os.getuid():
            raise PreprodError(label + ' must belong to the deployment user')
        if stat.S_IMODE(info.st_mode) not in (0o400, 0o600):
            raise PreprodError(label + ' requires permissions 600 or 400')
    except OSError:
        raise PreprodError(label + ' is missing or unreadable') from None


def compose_environment():
    # Shell exports must not override the explicit env file (Compose precedence).
    # In particular, neither COMPOSE_* nor DOCKER_* can select a different stack/host.
    return {name: os.environ[name] for name in
            ('PATH', 'HOME', 'USER', 'LOGNAME', 'TERM', 'LANG', 'LC_ALL') if name in os.environ}


def invoke_compose(env_file, args, repo_root=REPO_ROOT):
    try:
        return subprocess.run(
            ['sudo', 'docker', 'compose', '--env-file', str(env_file),
             '-f', 'compose.yml', '-f', 'compose.preprod.yml', *args],
            cwd=repo_root, env=compose_environment(), capture_output=True, text=True,
        )
    except (OSError, UnicodeError):
        raise PreprodError('cannot execute local sudo docker compose') from None


def check_configuration(env_file, repo_root=REPO_ROOT):
    private_file(env_file, repo_root, 'Environment file')
    # Let Compose parse dotenv quoting/escapes/interpolation, not Bash or a second parser.
    # Values are captured in memory only. Never print this command's output or stderr.
    result = invoke_compose(env_file, ['config', '--no-interpolate', '--environment'], repo_root)
    if result.returncode:
        raise PreprodError('Compose cannot read the environment file; check syntax and Compose installation')
    values = {}
    for line in result.stdout.splitlines():
        name, separator, value = line.partition('=')
        if not separator or not re.fullmatch(r'[A-Za-z_][A-Za-z0-9_]*', name) or name in values:
            raise PreprodError('environment values must be single-line values')
        values[name] = value
    for name in REQUIRED:
        if not values.get(name, '').strip():
            raise PreprodError('required variable ' + name + ' is missing')
    # Compose itself adds these two metadata entries even with an empty env file.
    metadata = {'COMPOSE_PROJECT_NAME', 'DOCKER_CLI_PLUGIN_ORIGINAL_CLI_COMMAND'}
    if (any(name.startswith(('COMPOSE_', 'DOCKER_')) and name not in metadata for name in values) or
            values.get('COMPOSE_PROJECT_NAME', repo_root.name) != repo_root.name):
        raise PreprodError('COMPOSE_* and DOCKER_* overrides are not allowed in preprod.env')
    for name in ('COOKIE_SECURE', 'PUSH_ENABLED'):
        if values[name].lower() != 'true':
            raise PreprodError(name + ' must be true for normal Pre-Production deployment')
    if values['FIREBASE_PROJECT_ID'] != 'metalcircle-30d9b':
        raise PreprodError('FIREBASE_PROJECT_ID does not match the Pre-Production project')
    private_file(Path(values['FIREBASE_SERVICE_ACCOUNT_FILE']), repo_root, 'Firebase secret')
    return values


def backup_environment(env_file, repo_root=REPO_ROOT):
    private_file(env_file, repo_root, 'Environment file')
    directory = env_file.parent / 'backups'
    directory.mkdir(mode=0o700, exist_ok=True)
    info = directory.lstat()
    if (not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid() or
            stat.S_IMODE(info.st_mode) != 0o700):
        raise PreprodError('backup directory must belong to the deployment user and have permissions 700')
    name = 'preprod.env.' + datetime.now(timezone.utc).strftime('%Y%m%d-%H%M%S-%f')
    target = directory / name
    descriptor = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    try:
        with os.fdopen(descriptor, 'wb') as output:
            os.fchmod(output.fileno(), 0o600)
            output.write(env_file.read_bytes())
            output.flush()
            os.fsync(output.fileno())
    except OSError:
        target.unlink(missing_ok=True)
        raise
    backups = sorted(path for path in directory.iterdir()
                     if re.fullmatch(r'preprod\.env\.\d{8}-\d{6}-\d{6}', path.name))
    for old in backups[:-10]:
        private_file(old, repo_root, 'Environment backup')
        old.unlink()
    print('PASS: environment backup saved outside the repository; last 10 retained.')


def safe_logs(output):
    """Allowlist lifecycle/error categories; omit request paths and all free-form text."""
    count = 0
    for line in output.splitlines():
        request = re.search(r'"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS) .* HTTP/[0-9.]+" (\d{3})', line)
        category = re.search(r'Gitea issue submission failed: (wrong_account|configuration|invalid_response|'
                             r'invalid_attachment_response|network_or_timeout|HTTP [0-9]{3})\s*$', line)
        push_error = re.search(r'Push delivery failed: (configuration|unregistered|transient|permanent)\s*$', line)
        lifecycle = next((text for text in ('Application startup complete.', 'Application shutdown complete.',
                                            'Waiting for application startup.', 'Shutting down')
                          if line.rstrip().endswith(text)), None)
        if request:
            print('HTTP ' + request[1] + ' ' + request[2])
        elif category:
            print('Gitea: ' + category[1])
        elif push_error:
            print('Push: ' + push_error[1])
        elif lifecycle:
            print(lifecycle)
        else:
            count += 1
    if count:
        print(str(count) + ' other log lines omitted (secret/privacy protection).')


def run_compose(env_file, args):
    if not args or args[0] not in {'config', 'build', 'run', 'up', 'exec', 'ps', 'logs'}:
        raise PreprodError('unsupported deployment Compose command')
    private_file(env_file, REPO_ROOT, 'Environment file')
    result = invoke_compose(env_file, args)
    preflight = args[0] in {'run', 'exec'} and any(
        item in args for item in ('push_preflight.py', 'gitea_preflight.py'))
    if preflight:
        # Only our dedicated preflights' safe stdout; Docker stderr remains private.
        for line in result.stdout.splitlines():
            if line.startswith(('PASS: ', 'FAIL: ')):
                print(line)
        if (result.returncode or not result.stdout.startswith('PASS: ') or
                any(line.startswith('FAIL: ') for line in result.stdout.splitlines())):
            raise PreprodError('container preflight failed; deployment stopped')
    elif result.returncode:
        raise PreprodError('Compose ' + args[0] + ' failed; raw diagnostics suppressed to protect secrets')
    elif args[0] == 'logs':
        safe_logs(result.stdout)
    elif args[0] == 'ps':
        # Compose versions return either JSON arrays or one JSON object per line.
        try:
            rows = json.loads(result.stdout) if result.stdout.lstrip().startswith('[') else [
                json.loads(line) for line in result.stdout.splitlines() if line.strip()]
            for row in rows:
                print('Container:', row['Name'], '| state:', row['State'])
        except (ValueError, KeyError, TypeError):
            raise PreprodError('cannot parse Compose container status') from None


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--env-file', type=Path, required=True)
    parser.add_argument('action', choices=('check', 'fingerprint', 'backup', 'compose'))
    parser.add_argument('compose_args', nargs=argparse.REMAINDER)
    args = parser.parse_args()
    try:
        if args.action == 'check':
            check_configuration(args.env_file)
            for name in REQUIRED:
                print(name + ': set')
            print('PASS: environment and host secret checks.')
        elif args.action == 'fingerprint':
            # Captured by the shell, never displayed. Detect edits during build/preflights.
            values = check_configuration(args.env_file)
            digest = hashlib.sha256(args.env_file.read_bytes())
            digest.update(b'\x00')
            digest.update(Path(values['FIREBASE_SERVICE_ACCOUNT_FILE']).read_bytes())
            print(digest.hexdigest())
        elif args.action == 'backup':
            backup_environment(args.env_file)
        else:
            run_compose(args.env_file, args.compose_args)
    except PreprodError as error:
        print('ERROR: ' + str(error))
        return 1
    except (OSError, ValueError):
        print('ERROR: host file operation failed; check permissions and available disk space')
        return 1
    return 0


if __name__ == '__main__':
    raise SystemExit(main())