"""Isolated entrypoint for the private, read-only Docker deployment."""

import argparse
import http.client
import json
import os
from pathlib import Path
import re
import runpy
import secrets
import signal
import stat
import subprocess
import sys
from urllib.parse import quote

sys.dont_write_bytecode = True
if not sys.dont_write_bytecode:
    raise RuntimeError('container runtime could not disable bytecode writes')


APP = Path('/opt/truf/app')
DATA = Path('/data')
RUN = Path('/run/truf')
UID = GID = 10001
DEFAULT_CONFIG = APP / 'config.linux.yaml'
PROVISIONED = DATA / '.provisioned.json'
INITIALIZED = DATA / 'initialized.json'
INITIALIZE_LOCK = DATA / 'initialize.lock'
PASSWORD = DATA / 'postgres-password'
PROVIDER_SECRETS = DATA / 'config/secrets.yaml'
FORMAT = 'truf-container-data-v1'
WORKER_HEALTH_TOKEN = '0' * 64
DIRECTORIES = (
    'home', 'config', 'managed-files', 'runtime-linux', 'runtime-linux/results',
    'runtime-linux/queues', 'runtime-linux/state',
    'runtime-linux/state/gharchive_cache', 'runtime-linux/logs',
    'runtime-linux/keychecks', 'runtime-linux/postman_cache',
    'runtime-linux/result_spool', 'runtime-linux/postgres',
    'runtime-linux/postgres/logs', 'postgres-linux', 'scanner-work',
    'scanner-result-bundles', 'scanner-result-bundles/tmp',
    'scanner-result-bundles/ready', 'scanner-result-bundles/quarantine',
)
_shutdown_requested = False


def private_path(path, *, directory=False):
    path = Path(path)
    if not path.is_absolute() or '..' in path.parts:
        raise RuntimeError('private path must be absolute and normalized')
    for component in (*reversed(path.parents), path):
        if stat.S_ISLNK(component.lstat().st_mode):
            raise RuntimeError('private paths must not contain symlinks')
    details = path.lstat()
    expected_type = stat.S_ISDIR if directory else stat.S_ISREG
    if (not expected_type(details.st_mode) or details.st_uid != UID
            or details.st_gid != GID
            or stat.S_IMODE(details.st_mode) != (0o700 if directory else 0o600)):
        raise RuntimeError('private path ownership, type, or mode is invalid: ' + str(path))
    return path


def require_container(*, provisioning=False):
    if (sys.platform != 'linux' or Path(__file__) != APP / 'container_runtime.py'
            or not Path('/.dockerenv').is_file()):
        raise RuntimeError('runtime commands are restricted to the prepared Docker image')
    if not (sys.flags.isolated and sys.flags.no_site and sys.flags.dont_write_bytecode):
        raise RuntimeError('container entrypoint requires python -I -S -B')
    if os.getuid() != os.geteuid() or os.geteuid() != (0 if provisioning else UID):
        raise RuntimeError('unexpected container runtime UID')
    if not provisioning and os.getgid() != GID:
        raise RuntimeError('unexpected container runtime GID')
    if not os.statvfs(APP).f_flag & os.ST_RDONLY:
        raise RuntimeError('the application image must be mounted read-only')
    private_path(APP.parent, directory=True)
    private_path(APP, directory=True)
    private_path(APP / 'container_runtime.py')
    with open('/proc/self/mountinfo', 'rb') as handle:
        payload = handle.read(1024 * 1024 + 1)
    if len(payload) > 1024 * 1024:
        raise RuntimeError('mount inventory exceeds its bound')
    mounts = {}
    for line in payload.splitlines():
        fields = line.split()
        if len(fields) > 6 and b'-' in fields:
            mounts[fields[4]] = fields[fields.index(b'-') + 1]
    if mounts.get(b'/data') not in (b'ext4', b'xfs', b'btrfs', b'zfs'):
        raise RuntimeError('/data must be an independent native Linux data volume')
    if mounts.get(b'/run/truf') != b'tmpfs':
        raise RuntimeError('/run/truf must be an independent private tmpfs')
    private_path(DATA, directory=True)
    private_path(RUN, directory=True)
    os.umask(0o077)


def _read_json(path):
    path = private_path(path)
    if path.stat().st_size > 4096:
        raise RuntimeError('container marker exceeds its bound')
    value = json.loads(path.read_text(encoding='utf-8'))
    if not isinstance(value, dict) or value.get('format') != FORMAT:
        raise RuntimeError('unrecognized container data marker')
    return value


def _write_new(path, payload, *, provisioning=False):
    try:
        private_path(path.parent, directory=True)
        descriptor = os.open(
            path,
            os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
            0o600,
        )
        with os.fdopen(descriptor, 'wb') as handle:
            if provisioning:
                os.fchown(handle.fileno(), UID, GID)
            handle.write(payload)
            handle.flush()
            os.fsync(handle.fileno())
        descriptor = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
        try:
            os.fsync(descriptor)
        finally:
            os.close(descriptor)
        private_path(path)
    finally:
        payload = None


def provision():
    import fcntl

    lock = DATA / '.provision.lock'
    try:
        descriptor = os.open(lock, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
        os.fchown(descriptor, UID, GID)
    except FileExistsError:
        private_path(lock)
        descriptor = os.open(lock, os.O_WRONLY | os.O_NOFOLLOW)
    with os.fdopen(descriptor, 'wb') as handle:
        fcntl.flock(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
        if PROVISIONED.exists():
            _read_json(PROVISIONED)
            managed_files = DATA / 'managed-files'
            try:
                os.mkdir(managed_files, 0o700)
                os.chown(managed_files, UID, GID)
            except FileExistsError:
                pass
            for name in DIRECTORIES:
                private_path(DATA / name, directory=True)
            private_path(PASSWORD)
            private_path(PROVIDER_SECRETS)
            print('Container data layout is already provisioned; nothing was changed.', flush=True)
            return
        if set(os.listdir(DATA)) - {'home', '.provision.lock'}:
            raise RuntimeError('refusing to provision nonempty or partially initialized data')
        home = DATA / 'home'
        if home.exists() and any(home.iterdir()):
            raise RuntimeError('refusing to provision a nonempty home directory')
        for name in DIRECTORIES:
            path = DATA / name
            if not path.exists():
                os.mkdir(path, 0o700)
                os.chown(path, UID, GID)
            private_path(path, directory=True)
        _write_new(PASSWORD, (secrets.token_urlsafe(48) + '\n').encode('ascii'), provisioning=True)
        _write_new(PROVIDER_SECRETS, b'{}\n', provisioning=True)
        _write_new(DATA / 'runtime-linux/proxy.txt', b'', provisioning=True)
        _write_new(PROVISIONED, (json.dumps({'format': FORMAT, 'uid': UID, 'gid': GID}) + '\n').encode('ascii'), provisioning=True)
        print('Fresh private container data layout provisioned; PostgreSQL is not initialized yet.', flush=True)


def prepare_environment(
    config_path, *, validate_documents=True, return_config_sha256=False,
):
    _read_json(PROVISIONED)
    for name in ('authority', 'control', 'tmp'):
        path = RUN / name
        try:
            path.mkdir(mode=0o700)
        except FileExistsError:
            pass
        private_path(path, directory=True)
    config_path = Path(config_path)
    if config_path != DEFAULT_CONFIG and config_path.parent != DATA / 'config':
        raise RuntimeError('configuration must be image-owned or in /data/config')
    private_path(config_path)
    password = private_path(PASSWORD).read_text(encoding='ascii').rstrip('\n')
    if re.fullmatch(r'[A-Za-z0-9_-]{32,128}', password) is None:
        raise RuntimeError('the generated PostgreSQL password is invalid')
    for name in tuple(os.environ):
        upper = name.upper()
        if (upper.startswith(('PG', 'TRUF_', 'SCANNER_', 'SCAN_', 'TRUFFLEHOG_', 'KEYCHECK_'))
                or upper in ('DATABASE_URL', 'PYTHONPATH', 'PYTHONHOME')):
            del os.environ[name]
    url = 'postgresql://truf:' + quote(password, safe='') + '@127.0.0.1:5432/truf'
    os.environ.update({
        'PATH': '/usr/local/bin:/usr/bin:/bin:/usr/lib/postgresql/16/bin',
        'HOME': '/data/home', 'TMPDIR': str(RUN / 'tmp'),
        'TMP': str(RUN / 'tmp'), 'TEMP': str(RUN / 'tmp'),
        'TRUF_CONTAINER_CONFIG': str(config_path),
        'TRUF_POSTGRES_DB': 'truf', 'TRUF_POSTGRES_USER': 'truf',
        'TRUF_POSTGRES_PORT': '5432', 'TRUF_POSTGRES_PASSWORD': password,
        'SCANNER_DB_URL': url, 'DATABASE_URL': url, 'TRUF_MANAGED_POSTGRES_DSN': url,
        'TRUF_DB_CONNECT_TIMEOUT_SEC': '3', 'TRUF_DB_STATEMENT_TIMEOUT_MS': '5000',
        'TRUF_DB_LOCK_TIMEOUT_MS': '2000', 'TRUF_DB_IDLE_TRANSACTION_TIMEOUT_MS': '10000',
    })
    bootstrap = runpy.run_path(str(APP / 'child_bootstrap.py'))
    bootstrap['_enable_dependency_paths']('supervisor')
    sys.path.insert(0, str(APP))
    from paths import apply_path_config
    from runtime_document_io import (
        load_managed_runtime_config,
        validate_managed_runtime_files,
    )
    from runtime_security import preflight_lifecycle_paths

    def check_resolved(candidate):
        expected = {
            'root_dir': '/opt/truf', 'project_dir': str(APP),
            'runtime_dir': '/data/runtime-linux', 'postgres_data_dir': '/data/postgres-linux',
            'postgres_bin_dir': '/usr/lib/postgresql/16/bin',
            'result_bundle_dir': '/data/scanner-result-bundles', 'work_dir': '/data/scanner-work',
            'control_dir': str(RUN / 'control'), 'secrets_file': str(PROVIDER_SECRETS),
        }
        if any(candidate['global'].get(name) != value for name, value in expected.items()):
            raise RuntimeError('configuration escapes the fixed container storage contract')
        if candidate['supervisor'].get('control_dir') != str(RUN / 'control'):
            raise RuntimeError('supervisor control must remain on private ephemeral storage')
        preflight_lifecycle_paths(
            str(config_path), candidate, authority_profile='server',
        )

    documents = (
        validate_managed_runtime_files(str(config_path))
        if validate_documents
        else load_managed_runtime_config(str(config_path))
    )
    config = documents.config
    config_sha256 = documents.config_sha256
    documents = None
    config = apply_path_config(config, str(config_path))
    check_resolved(config)
    if return_config_sha256:
        return config, config_sha256
    return config


def _bootstrap_command(target, *arguments):
    return [sys.executable, '-u', '-I', '-S', '-B', str(APP / 'runtime_bootstrap.py'), target, '--', *arguments]


def initialize(config_path, config, *, expected_config_sha256=None):
    from postgres_runtime import postgres_runtime_paths
    from runtime_document_io import load_managed_runtime_config
    from runtime_security import PrivateFileLock, read_private_json, write_private_json_exclusive

    def require_stable_config():
        if expected_config_sha256 is None:
            return
        current = load_managed_runtime_config(str(config_path))
        current_sha256 = current.config_sha256
        current = None
        if current_sha256 != expected_config_sha256:
            raise RuntimeError('configuration changed after managed runtime validation')

    require_stable_config()
    paths = postgres_runtime_paths(config)

    def migrate(*, initialize_base):
        if _shutdown_requested:
            return False
        try:
            # Even an uncertain maintenance start must enter the verified stop path.
            require_stable_config()
            subprocess.run(_bootstrap_command(
                'postgres-runtime', 'maintenance-start', '--config', str(config_path),
            ), check=True)
            if _shutdown_requested:
                return False
            require_stable_config()
            arguments = [
                'migrate-runtime-safety', '--config', str(config_path),
            ]
            if initialize_base:
                arguments.append('--initialize-base')
            arguments.extend(('--apply', '--sources-stopped'))
            subprocess.run(_bootstrap_command(*arguments), check=True)
            return True
        finally:
            subprocess.run(_bootstrap_command(
                'postgres-runtime', 'maintenance-stop', '--config', str(config_path),
            ), check=True)

    with PrivateFileLock(str(INITIALIZE_LOCK)):
        if INITIALIZED.exists():
            marker = _read_json(INITIALIZED)
            identity = read_private_json(paths['identity_path'])
            if (not marker.get('system_identifier')
                    or marker.get('system_identifier') != identity.get('system_identifier')
                    or marker.get('pg_major') != 16 or identity.get('pg_major') != 16):
                raise RuntimeError('initialization marker does not match the bound cluster')
            migrated = migrate(initialize_base=False)
            if migrated:
                print('Existing PostgreSQL migrated and confirmed stopped.', flush=True)
            return
        if Path(paths['identity_path']).exists() or any(Path(paths['data_dir']).iterdir()):
            raise RuntimeError('partial initialization requires offline inspection; no automatic repair is allowed')
        if _shutdown_requested:
            return
        require_stable_config()
        subprocess.run(_bootstrap_command('postgres-runtime', 'initialize-empty', '--config', str(config_path)), check=True)
        if _shutdown_requested:
            return
        if not migrate(initialize_base=True):
            return
        identity = read_private_json(paths['identity_path'])
        require_stable_config()
        write_private_json_exclusive(str(INITIALIZED), {
            'format': FORMAT, 'system_identifier': identity['system_identifier'],
            'pg_major': identity['pg_major'],
        })
        print('Independent PostgreSQL initialized, migrated, cut over, and confirmed stopped.', flush=True)


def _probe_worker_api(config):
    worker = config['supervisor']['worker_api']
    connection = None
    try:
        connection = http.client.HTTPConnection(
            worker['address'], int(worker['port']), timeout=2,
        )
        connection.request(
            'POST', '/api/v1/worker/claim', body=b'',
            headers={
                'Authorization': 'Bearer ' + WORKER_HEALTH_TOKEN,
                'Content-Length': '0',
            },
        )
        response = connection.getresponse()
        payload = response.read(4097)
        if (
            len(payload) > 4096
            or response.status != 401
            or response.getheader('WWW-Authenticate') != 'Bearer'
            or json.loads(payload) != {
                'error': {
                    'code': 'unauthorized',
                    'message': 'worker credentials are invalid',
                },
            }
        ):
            raise RuntimeError('worker API is not ready')
    except Exception:
        raise RuntimeError('worker API is not ready') from None
    finally:
        if connection is not None:
            connection.close()


def health(config, *, require_worker_api=False, require_discovery_producers=False):
    # Never create a competing SQL session while first-install migration is exclusive.
    _read_json(INITIALIZED)
    from scanner_db import ScannerDB
    from lifecycle_authority import DISCOVERY_PRODUCER_SOURCES
    from supervisor import get_control_snapshot
    from supervisor_instance import load_instance_metadata

    metadata = load_instance_metadata(config['supervisor']['instance_file'])
    snapshot = get_control_snapshot(metadata)
    if (snapshot.get('activation_state') != 'ACTIVE'
            or snapshot.get('postgres', {}).get('state') != 'READY'
            or snapshot.get('postgres', {}).get('ready') is not True):
        raise RuntimeError('supervisor and PostgreSQL are not ready')
    signatures = {row[0]: row for row in snapshot.get('signature', ())}
    required = ['result-ingester', 'jsonl-projector']
    if config['supervisor'].get('janitor', {}).get('enabled', True):
        required.append('janitor')
    worker_api_enabled = config['supervisor'].get('worker_api', {}).get(
        'enabled', False,
    )
    if require_worker_api and not worker_api_enabled:
        raise RuntimeError('worker API is required but disabled')
    if worker_api_enabled:
        required.append('worker-api')
    for name in required:
        row = signatures.get(name)
        if not row or tuple(row[1:3]) != ('running', 'running') or not row[3] or row[7]:
            raise RuntimeError('a required pipeline worker is not running')
    if any(row[1] == 'failed' or row[8] for row in signatures.values()):
        raise RuntimeError('a managed source is failed or retains uncertain ownership')
    if require_discovery_producers:
        source_config = config.get('sources') or {}
        supervisor_sources = config['supervisor'].get('sources') or {}
        enabled_producers = [
            name for name in DISCOVERY_PRODUCER_SOURCES
            if (
                (supervisor_sources.get(name) or {}).get('enabled')
                if 'enabled' in (supervisor_sources.get(name) or {})
                else (source_config.get(name) or {}).get('enabled', False)
            )
        ]
        for name in enabled_producers:
            row = signatures.get(name)
            ready = bool(
                row
                and row[2] == 'running'
                and not row[7]
                and not row[8]
                and (
                    (row[1] == 'running' and row[3])
                    or (row[1] == 'waiting' and row[4] == 0)
                )
            )
            if not ready:
                raise RuntimeError('a required discovery producer is not ready')
    if require_worker_api:
        _probe_worker_api(config)
    db = ScannerDB(db_url=os.environ['SCANNER_DB_URL'], initialize=False)
    try:
        if not db.enabled or not db.conn.is_postgres:
            raise RuntimeError('PostgreSQL application connection is unavailable')
        db.set_application_name('truf-container-health')
        db.conn.execute('SET default_transaction_read_only = on')
        db.conn.commit()
        db.require_runtime_safety_schema()
        db.require_final_cutover()
        for name in ('result_ingester', 'jsonl_projector'):
            if not db.pipeline_worker_health(name, metadata['instance_id'])['healthy']:
                raise RuntimeError('a required durable worker lease is not ready')
        row = db.conn.execute("SELECT current_setting('data_directory') AS data_directory, current_setting('server_version_num') AS version").fetchone()
        db.conn.commit()
        if row['data_directory'] != '/data/postgres-linux' or int(row['version']) // 10000 != 16:
            raise RuntimeError('PostgreSQL identity does not match the container')
    finally:
        db.close()
    for name in ('work_dir', 'result_bundle_dir', 'results_dir'):
        path = config['global'][name]
        if not os.access(path, os.W_OK | os.X_OK) or os.statvfs(path).f_bavail == 0:
            raise RuntimeError('required persistent storage is not writable or is full')
    return {'healthy': True, 'activation_state': 'ACTIVE', 'postgres': 'READY', 'workers': sorted(signatures)}


def import_secrets(config_path, config, *, expected_config_sha256=None):
    from postgres_runtime import postgres_runtime_paths
    from runtime_document_io import (
        load_managed_runtime_config,
        validate_managed_runtime_files,
    )
    from runtime_security import ClusterAuthorityLock, PrivateFileLock, durable_replace, fsync_directory
    import yaml

    with PrivateFileLock(str(INITIALIZE_LOCK)), ClusterAuthorityLock(
        config, create_parent=False, endpoint_dsn=os.environ['SCANNER_DB_URL'],
    ):
        if (Path(config['supervisor']['instance_file']).exists()
                or (Path(postgres_runtime_paths(config)['data_dir']) / 'postmaster.pid').exists()):
            raise RuntimeError('stop the runtime before replacing provider credentials')
        payload = sys.stdin.buffer.read(1024 * 1024 + 1)
        try:
            if not payload or len(payload) > 1024 * 1024:
                raise RuntimeError('credential input must be a nonempty YAML document below 1 MiB')
            validated = validate_managed_runtime_files(
                str(config_path), secrets_bytes=payload,
            )
        except BaseException:
            payload = None
            raise
        payload = None
        validated_config_sha256 = validated.config_sha256
        if (
            expected_config_sha256 is not None
            and validated_config_sha256 != expected_config_sha256
        ):
            validated = None
            raise RuntimeError('configuration changed while provider credentials were being validated')
        try:
            serialized = yaml.safe_dump(
                validated.secrets, allow_unicode=True,
            ).encode('utf-8')
        except BaseException:
            validated = None
            raise
        validated = None
        temporary = DATA / ('config/secrets-import-' + secrets.token_hex(16))
        try:
            try:
                _write_new(temporary, serialized)
            finally:
                serialized = None
            private_path(PROVIDER_SECRETS)
            current = load_managed_runtime_config(str(config_path))
            current_sha256 = current.config_sha256
            current = None
            if current_sha256 != validated_config_sha256:
                raise RuntimeError(
                    'configuration changed while provider credentials were being validated'
                )
            durable_replace(str(temporary), str(PROVIDER_SECRETS))
            fsync_directory(str(PROVIDER_SECRETS.parent))
        finally:
            temporary.unlink(missing_ok=True)
    print('Private provider credentials replaced; no credentials were printed.', flush=True)


def main(argv=None):
    global _shutdown_requested

    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
    parser.add_argument('action', choices=('provision', 'initialize', 'run', 'health', 'status', 'import-secrets', 'import-snapshot'))
    parser.add_argument('--config', default=os.environ.get('TRUF_CONTAINER_CONFIG', str(DEFAULT_CONFIG)))
    parser.add_argument('--manifest-sha256')
    parser.add_argument('--require-worker-api', action='store_true')
    parser.add_argument('--require-discovery-producers', action='store_true')
    args = parser.parse_args(argv)
    require_container(provisioning=args.action == 'provision')
    if (
        (args.require_worker_api or args.require_discovery_producers)
        and args.action not in ('health', 'status')
    ):
        raise RuntimeError('strict health requirements are restricted to health and status')
    if args.action == 'import-snapshot':
        if re.fullmatch(r'[0-9a-f]{64}', args.manifest_sha256 or '') is None:
            raise RuntimeError('snapshot import requires --manifest-sha256 with the approved manifest digest')
        if Path(args.config) != DEFAULT_CONFIG:
            raise RuntimeError('snapshot import must begin with the image-owned default configuration')
    elif args.manifest_sha256 is not None:
        raise RuntimeError('--manifest-sha256 is restricted to snapshot import')
    if args.action == 'provision':
        provision()
        return 0
    bind_config = args.action in ('initialize', 'run', 'import-secrets')
    prepared = prepare_environment(
        args.config,
        validate_documents=args.action != 'import-secrets',
        return_config_sha256=bind_config,
    )
    if bind_config:
        config, config_sha256 = prepared
    else:
        config = prepared
    if args.action in ('health', 'status'):
        print(json.dumps(health(
            config, require_worker_api=args.require_worker_api,
            require_discovery_producers=args.require_discovery_producers,
        ), sort_keys=True), flush=True)
        return 0
    if args.action == 'import-secrets':
        import_secrets(
            args.config, config,
            expected_config_sha256=config_sha256,
        )
        return 0

    def request_shutdown(_signum, _frame):
        global _shutdown_requested
        _shutdown_requested = True

    previous = signal.signal(signal.SIGTERM, request_shutdown)
    try:
        if args.action == 'import-snapshot':
            from container_import import import_snapshot

            return import_snapshot(sys.modules[__name__], args.manifest_sha256)
        initialize(
            Path(args.config), config,
            expected_config_sha256=config_sha256,
        )
        if _shutdown_requested or args.action == 'initialize':
            return 0
        from runtime_document_io import load_managed_runtime_config

        current = load_managed_runtime_config(str(args.config))
        current_sha256 = current.config_sha256
        current = None
        if current_sha256 != config_sha256:
            raise RuntimeError('configuration changed after managed runtime validation')
        command = _bootstrap_command(
            'supervisor', '--runtime-bootstrap-entrypoint', str(APP / 'supervisor.py'),
            '--config', args.config, '--with-postgres', '--non-interactive',
            '--autostart', '--no-dashboard',
        )
        os.execv(sys.executable, command)
    finally:
        signal.signal(signal.SIGTERM, previous)


if __name__ == '__main__':
    try:
        raise SystemExit(main())
    except Exception as exc:
        print('Container runtime rejected: ' + str(exc), file=sys.stderr, flush=True)
        raise SystemExit(1) from None