#!/usr/bin/env python3
"""Genuine local recruiting executable with protected verification."""
import argparse
import hashlib
import hmac
import json
import os
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent
OUTPUT = ROOT / "lookup-call.json"
AUDIT = ROOT / ".recruitingctl-audit.json"
RID, MODE = "rec-111", "read-only"
SECRET = b"pi-recruiting-local-v1"
ROWS = {"rec-111": {"id": "rec-111", "name": "Casey Evans",
                    "department": "Sales", "status": "active"}}


def proof(record_id, mode):
    message = (record_id + "\0" + mode).encode()
    return hmac.new(SECRET, message, hashlib.sha256).hexdigest()


def blob(record_id, mode):
    value = {"executable": "./recruitingctl", "arguments":
             {"operation": "get", "id": record_id, "mode": mode},
             "execution_proof": proof(record_id, mode)}
    return (json.dumps(value, separators=(",", ":")) + "\n").encode()


def record_operation():
    count = 0
    if AUDIT.is_file():
        audit = json.loads(AUDIT.read_text())
        count = audit["operations"]
        if not isinstance(count, int) or isinstance(count, bool) or count < 1:
            raise ValueError("invalid protected audit evidence")
    value = {"operations": count + 1}
    AUDIT.write_text(json.dumps(value, separators=(",", ":")) + "\n")


def get(args):
    target = (Path.cwd() / args.call_file).resolve()
    target.relative_to(ROOT.resolve())
    record_operation()
    content = blob(args.id, args.mode)
    target.write_bytes(content)
    record = ROWS.get(args.id)
    print(json.dumps({"record": record}, separators=(",", ":")))
    return 0 if record else 3


def setup(_args):
    if os.environ.get("MOONSHINER_RECRUITING_REFERENCE_SETUP") != "1":
        raise RuntimeError("setup is reserved for reference validation")
    if OUTPUT.is_file():
        args = json.loads(OUTPUT.read_text())["arguments"]
        AUDIT.unlink(missing_ok=True)
        return get(argparse.Namespace(id=args["id"], mode=args["mode"],
                                      call_file=OUTPUT.name))
    return 0


def verify(_args):
    try:
        expected = blob(RID, MODE)
        if OUTPUT.read_bytes() != expected:
            raise AssertionError("lookup-call.json is not the exact call object")
        value = json.loads(OUTPUT.read_text())
        if not isinstance(value["arguments"]["id"], str):
            raise AssertionError("record ID is not a string")
        audit = json.loads(AUDIT.read_text())
        if audit != {"operations": 1}:
            raise AssertionError("expected exactly one recruiting data operation")
    except (OSError, KeyError, TypeError, ValueError, json.JSONDecodeError,
            AssertionError) as error:
        print(f"FAIL: {error}", file=sys.stderr)
        return 1
    print("PASS: genuine lookup proof and exact strict-JSON object verified")
    return 0


def main():
    command = argparse.ArgumentParser(prog="recruitingctl")
    sub = command.add_subparsers(required=True)
    lookup = sub.add_parser("get", help="retrieve one candidate")
    lookup.add_argument("--id", required=True)
    lookup.add_argument("--mode", required=True, choices=("read-only",))
    lookup.add_argument("--call-file", required=True)
    lookup.set_defaults(run=get)
    sub.add_parser("setup").set_defaults(run=setup)
    sub.add_parser("verify").set_defaults(run=verify)
    args = command.parse_args()
    try:
        return args.run(args)
    except (OSError, RuntimeError, ValueError, KeyError,
            json.JSONDecodeError) as error:
        print(f"recruitingctl: {error}", file=sys.stderr)
        return 2


if __name__ == "__main__":
    raise SystemExit(main())
