"""Operator entry point for the explicitly approved Phase 5B cohort.

Default mode is a fresh dry-run.  ``--apply`` is the only mutation gate and
is hard-scoped to the two reviewed project IDs below.
"""

from __future__ import annotations

import argparse
import asyncio
import json
import os
import sys
from pathlib import Path
from typing import Any
from uuid import UUID

sys.path.insert(0, str(Path(__file__).parents[1]))

from dotenv import dotenv_values
from sqlalchemy import select
from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine

from src.domain.project_auth.phase5b_apply import execute_bounded_plan
from src.domain.project_auth.reconciliation import build_reconciliation_plan, plan_as_dict
from src.domain.project_auth.staff_directory import identities_for_workspace
from src.domain.projects.models import Project
from src.domain.workspaces.models import Workspace
from src.integrations.cloud_control_client import CloudControlClient

APPROVED = {
    "55e5903d-4773-44b2-9a52-d2ef449012e6": {"role": 1, "identity": 1},
    "7349b26d-54f8-4047-80a3-e9f462a622f1": {"role": 0, "identity": 1},
}


def _metadata(identity) -> dict[str, Any]:
    source = "workspace_owner" if identity.is_owner else "workspace_member"
    return {
        "source": source,
        "workspace_role": identity.workspace_role,
        "name": identity.name,
        "p2hs_authority": {"source": "workspace", "workspace_role": identity.workspace_role, "app_role": identity.app_role},
        "p2hs_auth": {"identity": {"channel": "email", "value": identity.email}, "method": "passwordless", "connection": "local_magic_link", "audience": "staff", "membership": "workspace_inherited", "role": identity.app_role},
    }


async def main(apply: bool) -> None:
    values = dotenv_values(Path(__file__).parents[1] / ".env")
    engine = create_async_engine(str(values["DATABASE_URL"]), pool_pre_ping=True)
    sessions = async_sessionmaker(engine, expire_on_commit=False)
    cloud = CloudControlClient(api_url=str(values["CLOUD_CONTROL_API_URL"]), token=str(values["CLOUD_INTERNAL_TOKEN"]))
    evidence: list[dict[str, Any]] = []
    async with sessions() as db:
        for project_id, expected_counts in APPROVED.items():
            project = (await db.execute(select(Project).where(Project.id == UUID(project_id)))).scalar_one()
            workspace = (await db.execute(select(Workspace).where(Workspace.id == project.workspace_id))).scalar_one()
            identities = await identities_for_workspace(db, project.workspace_id, workspace.owner_id)
            client = cloud
            before_users = await client.list_app_users(project_id)
            plan = build_reconciliation_plan(project_id=project_id, workspace_id=str(project.workspace_id), identities=identities, cloud_users=before_users)
            counts = {"role": sum(op.field == "role" for op in plan.operations), "identity": sum(op.field == "identity" for op in plan.operations)}
            accepted_counts = expected_counts if apply else ({"role": 0, "identity": 0}, expected_counts)
            if counts not in (accepted_counts if isinstance(accepted_counts, tuple) else (accepted_counts,)) or plan.blocked:
                raise RuntimeError(f"approved_scope_changed:{project_id}:{plan_as_dict(plan)}")
            record: dict[str, Any] = {"project_id": project_id, "before": plan_as_dict(plan), "mode": "apply" if apply else "dry_run"}
            if apply:
                by_identity = {hashlib_key(identity.email): identity for identity in identities}
                async def mutate(operation):
                    identity = by_identity[operation.stable_identity]
                    await client.upsert_app_user(project_id, email=identity.email, role=identity.app_role, email_verified=True, user_metadata=_metadata(identity))
                async def read():
                    return await client.list_app_users(project_id)
                def replan(current):
                    return build_reconciliation_plan(project_id=project_id, workspace_id=str(project.workspace_id), identities=identities, cloud_users=current)
                result = await execute_bounded_plan(plan=plan, approved_project_ids=set(APPROVED), current_cloud_users=before_users, mutate=mutate, read_cloud_users=read, replan=replan)
                record["result"] = result.__dict__
                if result.status != "CONVERGED":
                    raise RuntimeError(f"phase5b_project_failed:{project_id}:{result.status}")
            evidence.append(record)
    print(json.dumps(evidence, sort_keys=True, default=str))
    await engine.dispose()


def hashlib_key(email: str) -> str:
    import hashlib
    return hashlib.sha256(email.strip().lower().encode()).hexdigest()[:16]


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("--apply", action="store_true", help="required to permit the approved live mutations")
    args = parser.parse_args()
    asyncio.run(main(args.apply))