#!/usr/bin/env python3
"""Source fingerprint and artifact verification; never touches USB devices."""
import argparse
import hashlib
import json
from pathlib import Path
import subprocess
import tomllib

ROOT = Path(__file__).resolve().parents[1]
COMPONENTS = {'gui': 'intake-gui', 'scanner': 'pc-intake', 'controller': 'intake-controller'}

def digest(path):
    return hashlib.sha256(path.read_bytes()).hexdigest()

def source_id():
    paths = []
    for component in COMPONENTS:
        base = ROOT / component
        paths.extend((base / 'src').rglob('*.rs'))
        paths.extend(p for p in [base / 'Cargo.toml', base / 'Cargo.lock', base / 'build.rs'] if p.exists())
    for folder in ['scripts', 'live']:
        paths.extend(p for p in (ROOT / folder).iterdir() if p.is_file())
    h = hashlib.sha256()
    for path in sorted(paths):
        h.update(str(path.relative_to(ROOT)).encode() + b'\0')
        h.update(path.read_bytes())
    return 'csr-' + h.hexdigest()[:20]

def create(path):
    binaries = {}
    for component, name in COMPONENTS.items():
        package = tomllib.loads((ROOT / component / 'Cargo.toml').read_text())['package']
        binary = ROOT / component / 'target/release' / name
        binaries[name] = {'version': package['version'], 'sha256': digest(binary)}
    build_id = source_id()
    version = subprocess.check_output([ROOT / 'gui/target/release/intake-gui', '--version'], text=True).strip()
    if build_id not in version:
        raise ValueError('GUI source fingerprint does not match current sources; rebuild release')
    manifest = {'schema_version': 1, 'build_id': build_id, 'rustc': subprocess.check_output(['rustc', '--version'], text=True).strip(), 'binaries': binaries}
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(manifest, indent=2) + '\n')

def verify(profile):
    root = profile / 'airootfs'
    manifest = json.loads((root / 'etc/csr-intake/release.json').read_text())
    for name, spec in manifest['binaries'].items():
        binary = root / 'usr/local/bin' / name
        if digest(binary) != spec['sha256']:
            raise ValueError(f'Binary hash mismatch: {name}')
        if not binary.stat().st_mode & 0o111:
            raise ValueError(f'Binary is not executable: {name}')
    version = subprocess.check_output([root / 'usr/local/bin/intake-gui', '--version'], text=True)
    if manifest['build_id'] not in version:
        raise ValueError('GUI build ID differs from release manifest')
    required = ['networkmanager', 'curl', 'ca-certificates', 'python', 'usbutils', 'smartmontools', 'alsa-utils', 'ffmpeg', 'stress-ng', 'xdg-utils', 'firefox']
    packages = (profile / 'packages.x86_64').read_text().splitlines()
    for package in required:
        if package not in packages:
            raise ValueError(f'Missing live package: {package}')
    for file in ['usr/local/bin/intake-login', 'usr/local/bin/intake-prepare', 'etc/systemd/system/getty@tty1.service.d/autologin.conf', 'etc/systemd/system/multi-user.target.wants/NetworkManager.service']:
        p = root / file
        if not p.exists() and not p.is_symlink():
            raise ValueError(f'Missing live startup file: {file}')
    print(f"Profile verified: {manifest['build_id']}")

def main():
    parser = argparse.ArgumentParser()
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('--source-id', action='store_true')
    group.add_argument('--create', type=Path)
    group.add_argument('--verify-profile', type=Path)
    args = parser.parse_args()
    if args.source_id: print(source_id())
    elif args.create: create(args.create)
    else: verify(args.verify_profile)

if __name__ == '__main__': main()