#!/usr/bin/env python3
"""Verify a JWeBot extension artifact without extracting it."""

from __future__ import annotations

import argparse
import json
import sys
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]
sys.path[:0] = [
    str(ROOT / "packages" / "jwebot-sdk" / "src"),
    str(ROOT / "packages" / "jwebot-kernel" / "src"),
]

from jwebot_kernel import (  # noqa: E402
    ReleaseError,
    load_release_record,
    verify_release,
    verify_release_signature,
)


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("artifact", type=Path)
    parser.add_argument("release", type=Path)
    parser.add_argument("--signature", type=Path)
    parser.add_argument("--allowed-signers", type=Path)
    parser.add_argument("--publisher")
    args = parser.parse_args()
    if (args.signature is None) != (args.allowed_signers is None):
        parser.error("--signature and --allowed-signers must be provided together")
    if args.publisher is not None and args.signature is None:
        parser.error("--publisher requires --signature and --allowed-signers")
    try:
        record = load_release_record(args.release)
        verify_release(args.artifact, record)
        signature = None
        if args.signature is not None:
            signature = verify_release_signature(
                args.release,
                args.signature,
                args.allowed_signers,
                expected_publisher=args.publisher,
            )
    except ReleaseError as error:
        parser.error(str(error))
    print(
        json.dumps(
            {
                "valid": True,
                "plugin_id": record.plugin_id,
                "author": record.author,
                "plugin_version": record.plugin_version,
                "source_digest": record.source_digest,
                "artifact_sha256": record.artifact_sha256,
                "signature_valid": signature is not None,
                "publisher": (
                    signature.publisher if signature is not None else None
                ),
            },
            ensure_ascii=False,
            sort_keys=True,
        )
    )
    return 0


if __name__ == "__main__":
    raise SystemExit(main())