#!/usr/bin/env python3
"""Audited, read-only concierge reservation interface."""

from __future__ import annotations

import csv
import fcntl
import hashlib
import hmac
import io
import json
import os
import sqlite3
import sys
from pathlib import Path


ROOT = Path(__file__).resolve().parent.parent
PROTECTED = ROOT / ".protected"
DATABASE = PROTECTED / "bookings.sqlite3"
EVIDENCE_KEY = PROTECTED / "evidence.key"
JOURNAL = ROOT / ".runtime" / "calls.jsonl"


def csv_record(row: tuple[str, str, str, str]) -> bytes:
    stream = io.StringIO(newline="")
    csv.writer(stream, lineterminator="\n").writerow(row)
    return stream.getvalue().encode("utf-8")


def append_evidence(
    argv: list[str],
    operation: str,
    record_id: str,
    exit_code: int,
    stdout: bytes,
) -> None:
    payload = {
        "argv": argv,
        "exit_code": exit_code,
        "operation": operation,
        "record_id": record_id,
        "stdout_sha256": hashlib.sha256(stdout).hexdigest(),
        "v": 1,
    }
    canonical = json.dumps(
        payload, ensure_ascii=False, separators=(",", ":"), sort_keys=True
    ).encode("utf-8")
    event = dict(payload)
    event["sig"] = hmac.new(
        EVIDENCE_KEY.read_bytes(), canonical, hashlib.sha256
    ).hexdigest()
    encoded = (
        json.dumps(event, ensure_ascii=False, separators=(",", ":"), sort_keys=True)
        + "\n"
    ).encode("utf-8")

    JOURNAL.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
    descriptor = os.open(JOURNAL, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
    try:
        fcntl.flock(descriptor, fcntl.LOCK_EX)
        os.write(descriptor, encoded)
        os.fsync(descriptor)
    finally:
        os.close(descriptor)


def retrieve(record_id: str) -> tuple[int, bytes, str]:
    try:
        uri = DATABASE.resolve().as_uri() + "?mode=ro"
        with sqlite3.connect(uri, uri=True) as connection:
            row = connection.execute(
                """
                SELECT id, name, location, status
                FROM reservations
                WHERE id = ?
                """,
                (record_id,),
            ).fetchone()
    except sqlite3.Error:
        return 70, b"", "concierge: reservation store unavailable\n"
    if row is None:
        return 3, b"", "concierge: reservation not found\n"
    return 0, csv_record(tuple(str(value) for value in row)), ""


def main() -> int:
    argv = sys.argv[1:]
    operation = argv[0] if argv else ""
    record_id = argv[2] if len(argv) == 3 and argv[1] == "--id" else ""

    if len(argv) != 3 or operation != "reservation" or argv[1] != "--id":
        exit_code, stdout, stderr = (
            64,
            b"",
            "usage: concierge reservation --id RESERVATION_ID\n",
        )
    elif not record_id:
        exit_code, stdout, stderr = 64, b"", "concierge: ID must not be empty\n"
    else:
        exit_code, stdout, stderr = retrieve(record_id)

    append_evidence(argv, operation, record_id, exit_code, stdout)
    if stdout:
        sys.stdout.buffer.write(stdout)
    if stderr:
        sys.stderr.write(stderr)
    return exit_code


if __name__ == "__main__":
    raise SystemExit(main())
