#!/usr/bin/env python3
from __future__ import annotations

import ast
import json
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]
BROKER = ROOT / "active-runtime" / "app" / "owner_authorization_broker.py"
ADAPTER = (
    ROOT
    / "active-runtime"
    / "app"
    / "aios_owner_authorization_broker_api.py"
)
OPENAPI = (
    ROOT
    / "docs"
    / "gitops"
    / "openapi-owner-authorization-broker-fragment.yaml"
)
SYSTEMD = (
    ROOT
    / "deploy"
    / "systemd"
    / "aios-gitops-model-api-owner-authorization-broker.conf.example"
)


def main() -> int:
    failures = []
    for path in (BROKER, ADAPTER):
        try:
            ast.parse(path.read_text(encoding="utf-8"))
        except Exception as exc:
            failures.append(f"{path}: {exc}")

    broker = BROKER.read_text(encoding="utf-8")
    for marker in [
        "WILDCARD_OWNER_CREDENTIAL_REJECTED",
        "OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE",
        "PRODUCTION_CAPABILITY_REJECTED",
        "PROVISIONING_BLOCKED",
        "owner_authorization_reference",
        "AuthorizedTaskWriterProvisioner",
    ]:
        if marker not in broker:
            failures.append(f"broker marker missing: {marker}")

    for marker in [
        "update-ref",
        "git branch",
        "git push",
        "gitops.tokens",
        "OpenBao",
    ]:
        if marker in broker:
            failures.append(f"broker contains forbidden direct mutation: {marker}")

    adapter = ADAPTER.read_text(encoding="utf-8")
    for marker in [
        "/api/governance/owner-authorizations",
        "AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED",
        "WILDCARD_OWNER_CREDENTIAL_REJECTED",
    ]:
        if marker not in adapter:
            failures.append(f"adapter marker missing: {marker}")

    schema = OPENAPI.read_text(encoding="utf-8")
    for marker in [
        "authorizeAndProvisionTaskWriter",
        "x-openai-isConsequential: true",
        "AUTHORIZE_TASK_WRITER_PROVISIONING",
        "const: false",
    ]:
        if marker not in schema:
            failures.append(f"OpenAPI marker missing: {marker}")

    systemd = SYSTEMD.read_text(encoding="utf-8")
    for marker in [
        "OWNER_AUTHORIZATION_BROKER_ENABLED=true",
        "OWNER_AUTHORIZATION_INTAKE_SCOPES",
        "OWNER_AUTHORIZATION_ALLOWED_IDENTITIES",
        "aios_owner_authorization_broker_api.py",
    ]:
        if marker not in systemd:
            failures.append(f"systemd marker missing: {marker}")

    if failures:
        print(json.dumps({"status": "FAILED", "failures": failures}, indent=2))
        return 1
    print(json.dumps({"status": "PASS", "files": 4}, indent=2))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())