#!/usr/bin/env python3
"""Open one current candidate record from the sandboxed recruiting archive."""

from __future__ import annotations

import fcntl
import hashlib
import hmac
import json
import os
from pathlib import Path
import sqlite3
import sys
from typing import Any


ROOT = Path(__file__).resolve().parent
SEED_PATH = ROOT / "data" / "candidates.sql"
EVIDENCE_DIR = ROOT / ".recruiting-evidence"
LEDGER_PATH = EVIDENCE_DIR / "session.jsonl"
SIGNING_KEY = b"moonshiner-recruiting-open-v1-27bd5c91"


def compact_json(value: Any) -> str:
    return json.dumps(value, sort_keys=True, separators=(",", ":"))


def digest(value: Any) -> str:
    return hashlib.sha256(compact_json(value).encode("utf-8")).hexdigest()


def seed_digest() -> str:
    return hashlib.sha256(SEED_PATH.read_bytes()).hexdigest()


def sign(record: dict[str, Any]) -> str:
    return hmac.new(
        SIGNING_KEY,
        compact_json(record).encode("utf-8"),
        hashlib.sha256,
    ).hexdigest()


def append_evidence(record: dict[str, Any]) -> None:
    EVIDENCE_DIR.mkdir(exist_ok=True)
    signed = dict(record)
    signed["signature"] = sign(record)
    with LEDGER_PATH.open("a", encoding="utf-8") as stream:
        fcntl.flock(stream.fileno(), fcntl.LOCK_EX)
        stream.write(compact_json(signed) + "\n")
        stream.flush()
        os.fsync(stream.fileno())
        fcntl.flock(stream.fileno(), fcntl.LOCK_UN)


def load_candidate(candidate_id: str) -> dict[str, str] | None:
    connection = sqlite3.connect(":memory:")
    connection.row_factory = sqlite3.Row
    try:
        connection.executescript(SEED_PATH.read_text(encoding="utf-8"))
        row = connection.execute(
            """
            SELECT id, full_name, role, stage, recruiter
              FROM candidates
             WHERE id = ? AND active = 1
            """,
            (candidate_id,),
        ).fetchone()
    finally:
        connection.close()
    if row is None:
        return None
    return {
        key: row[key]
        for key in ("id", "full_name", "role", "stage", "recruiter")
    }


def record_invalid_request(arguments: list[str]) -> int:
    result = {"error": "invalid_request"}
    append_evidence(
        {
            "version": 1,
            "action": "parse",
            "request": {"argv": arguments},
            "success": False,
            "result_sha256": digest(result),
            "seed_sha256": seed_digest(),
        }
    )
    print(compact_json(result), file=sys.stderr)
    return 2


def main() -> int:
    arguments = sys.argv[1:]
    if len(arguments) != 1:
        return record_invalid_request(arguments)
    request = {"id": arguments[0]}

    try:
        result = load_candidate(request["id"])
        success = result is not None
    except (OSError, UnicodeError, sqlite3.Error) as error:
        result = {"error": type(error).__name__}
        success = False

    append_evidence(
        {
            "version": 1,
            "action": "open",
            "request": request,
            "success": success,
            "result_sha256": digest(result),
            "seed_sha256": seed_digest(),
        }
    )

    if not success:
        print(compact_json({"error": "not_found"}), file=sys.stderr)
        return 4
    print(compact_json(result))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())
