"""
IwoooS Wazuh live metadata owner gate readback.

This module only exposes committed gate metadata plus public-safe Wazuh route
aggregate status. It never reads secret values, never queries hosts, and never
authorizes Wazuh active response, scans, restarts, reloads, or host writes.
"""

from __future__ import annotations

import json
from pathlib import Path
from typing import Any

from src.services.snapshot_paths import default_security_dir

_DEFAULT_SECURITY_DIR = default_security_dir(Path(__file__))
_SNAPSHOT_FILE = "wazuh-readonly-live-metadata-env-gate.snapshot.json"
_EXPECTED_SCHEMA = "iwooos_wazuh_readonly_live_metadata_env_gate_v1"

_REQUIRED_FALSE_BOUNDARIES = {
    "argocd_sync_authorized",
    "docker_restart_authorized",
    "firewall_change_authorized",
    "host_write_authorized",
    "k8s_secret_patch_authorized",
    "kali_active_scan_authorized",
    "nginx_gateway_workaround_authorized",
    "production_deploy_authorized",
    "raw_wazuh_payload_storage_allowed",
    "repo_write_authorized",
    "runtime_execution_authorized",
    "secret_value_collection_allowed",
    "wazuh_active_response_authorized",
    "wazuh_api_live_query_authorized",
}


def load_latest_iwooos_wazuh_live_metadata_gate(
    security_dir: Path | None = None,
    wazuh_live_status: dict[str, Any] | None = None,
    wazuh_live_http_status: int = 0,
) -> dict[str, Any]:
    """Load the committed Wazuh live metadata owner gate as a public-safe payload."""
    directory = security_dir or _DEFAULT_SECURITY_DIR
    snapshot = _load_snapshot(directory)
    _require_boundaries(snapshot)

    summary = _summary(snapshot)
    live_route = _live_route_summary(wazuh_live_status, wazuh_live_http_status)
    merged_summary = {
        "server_side_env_key_count": _int(summary.get("server_side_env_key_count")),
        "required_owner_field_count": _int(summary.get("required_owner_field_count")),
        "reviewer_check_count": _int(summary.get("reviewer_check_count")),
        "outcome_lane_count": _int(summary.get("outcome_lane_count")),
        "blocked_action_count": _int(summary.get("blocked_action_count")),
        "production_route_readback_passed_count": _int(summary.get("production_route_readback_passed_count")),
        "live_metadata_owner_response_received_count": _int(
            summary.get("live_metadata_owner_response_received_count")
        ),
        "live_metadata_owner_response_accepted_count": _int(
            summary.get("live_metadata_owner_response_accepted_count")
        ),
        "secret_source_metadata_accepted_count": _int(summary.get("secret_source_metadata_accepted_count")),
        "wazuh_manager_health_ref_accepted_count": _int(
            summary.get("wazuh_manager_health_ref_accepted_count")
        ),
        "readonly_account_scope_accepted_count": _int(summary.get("readonly_account_scope_accepted_count")),
        "post_enable_readback_passed_count": _int(summary.get("post_enable_readback_passed_count")),
        "wazuh_api_live_query_authorized_count": _int(summary.get("wazuh_api_live_query_authorized_count")),
        "wazuh_active_response_authorized_count": _int(summary.get("wazuh_active_response_authorized_count")),
        "host_write_authorized_count": _int(summary.get("host_write_authorized_count")),
        "runtime_gate_count": _int(summary.get("runtime_gate_count")),
        "wazuh_live_route_http_status": live_route["http_status"],
        "wazuh_live_route_degraded_count": live_route["degraded_count"],
        "wazuh_live_readonly_api_enabled_count": live_route["readonly_api_enabled_count"],
        "wazuh_live_agent_total": live_route["agent_total"],
        "wazuh_live_metadata_available_count": live_route["metadata_available_count"],
        "wazuh_live_status": live_route["status"],
    }

    return {
        "schema_version": "iwooos_wazuh_live_metadata_gate_readback_v1",
        "status": snapshot.get("status", "blocked_waiting_live_metadata_owner_response"),
        "mode": "committed_snapshot_readback_with_public_safe_wazuh_route_metadata",
        "source_refs": [f"docs/security/{_SNAPSHOT_FILE}", "GET /api/iwooos/wazuh"],
        "summary": merged_summary,
        "items": _items(merged_summary),
        "boundary_markers": _boundary_markers(merged_summary),
        "boundaries": {
            "runtime_execution_authorized": False,
            "secret_value_collection_allowed": False,
            "raw_wazuh_payload_storage_allowed": False,
            "wazuh_api_live_query_authorized": False,
            "wazuh_active_response_authorized": False,
            "host_write_authorized": False,
            "kali_active_scan_authorized": False,
            "k8s_secret_patch_authorized": False,
            "argocd_sync_authorized": False,
            "docker_restart_authorized": False,
            "nginx_gateway_workaround_authorized": False,
            "firewall_change_authorized": False,
            "not_authorization": True,
        },
        "no_false_green_rules": [
            "正式路由 200 不是即時查詢授權",
            "Wazuh 儀表板可見不是 manager registry 已驗收",
            "機密來源只能交付中繼資料，不得交付明文、片段或雜湊",
            "live metadata query、active response、host write 與 Kali active scan 是不同閘門",
            "owner response accepted、post-enable readback 與 runtime gate 仍全部維持 0",
        ],
    }


def _load_snapshot(directory: Path) -> dict[str, Any]:
    path = directory / _SNAPSHOT_FILE
    if not path.is_file():
        raise FileNotFoundError(f"{path}: Wazuh 即時中繼資料閘門快照不存在")
    with path.open(encoding="utf-8") as handle:
        payload = json.load(handle)
    if not isinstance(payload, dict):
        raise ValueError(f"{path}: expected JSON object")
    if payload.get("schema_version") != _EXPECTED_SCHEMA:
        raise ValueError(f"{path}: expected schema_version={_EXPECTED_SCHEMA}")
    return payload


def _summary(payload: dict[str, Any]) -> dict[str, Any]:
    summary = payload.get("summary")
    return summary if isinstance(summary, dict) else {}


def _int(value: Any) -> int:
    return value if isinstance(value, int) else 0


def _live_route_summary(payload: dict[str, Any] | None, http_status: int) -> dict[str, Any]:
    if not isinstance(payload, dict):
        return {
            "status": "not_checked_by_snapshot_loader",
            "http_status": 0,
            "degraded_count": 1,
            "readonly_api_enabled_count": 0,
            "agent_total": 0,
            "metadata_available_count": 0,
        }
    summary = _summary(payload)
    status_text = str(payload.get("status") or "unknown")
    metadata_available = status_text == "readonly_metadata_available"
    return {
        "status": status_text,
        "http_status": http_status if isinstance(http_status, int) else 0,
        "degraded_count": 0 if metadata_available else 1,
        "readonly_api_enabled_count": _int(summary.get("readonly_api_enabled_count")),
        "agent_total": _int(summary.get("agent_total")),
        "metadata_available_count": 1 if metadata_available else 0,
    }


def _items(summary: dict[str, Any]) -> list[dict[str, Any]]:
    return [
        _item(
            "release_readback",
            "ENV-1",
            "route_readback_passed",
            "steady" if summary["production_route_readback_passed_count"] == 1 else "warn",
            {"route_readback": summary["production_route_readback_passed_count"]},
        ),
        _item(
            "server_env_owner",
            "ENV-2",
            "waiting_owner_response",
            "locked",
            {
                "owner_received": summary["live_metadata_owner_response_received_count"],
                "owner_accepted": summary["live_metadata_owner_response_accepted_count"],
            },
        ),
        _item(
            "secret_metadata",
            "ENV-3",
            "metadata_only_waiting_acceptance",
            "locked",
            {"secret_metadata_accepted": summary["secret_source_metadata_accepted_count"]},
        ),
        _item(
            "manager_health",
            "ENV-4",
            "waiting_manager_health_ref",
            "warn",
            {
                "manager_health_accepted": summary["wazuh_manager_health_ref_accepted_count"],
                "live_route_degraded": summary["wazuh_live_route_degraded_count"],
            },
        ),
        _item(
            "readonly_scope",
            "ENV-5",
            "waiting_readonly_scope_ref",
            "warn",
            {"readonly_scope_accepted": summary["readonly_account_scope_accepted_count"]},
        ),
        _item(
            "post_enable_readback",
            "ENV-6",
            "waiting_post_enable_readback",
            "locked",
            {
                "post_enable_readback": summary["post_enable_readback_passed_count"],
                "live_query_authorized": summary["wazuh_api_live_query_authorized_count"],
                "runtime_gate": summary["runtime_gate_count"],
            },
        ),
    ]


def _item(
    item_id: str,
    check: str,
    state_key: str,
    tone: str,
    metrics: dict[str, int],
) -> dict[str, Any]:
    return {
        "item_id": item_id,
        "check": check,
        "state_key": state_key,
        "tone": tone,
        "metrics": metrics,
    }


def _boundary_markers(summary: dict[str, Any]) -> list[str]:
    return [
        f"正式路由讀回={summary['production_route_readback_passed_count']}",
        f"負責人回覆接受={summary['live_metadata_owner_response_accepted_count']}",
        f"機密來源中繼資料接受={summary['secret_source_metadata_accepted_count']}",
        f"管理節點健康參照接受={summary['wazuh_manager_health_ref_accepted_count']}",
        f"唯讀帳號範圍接受={summary['readonly_account_scope_accepted_count']}",
        f"啟用後讀回={summary['post_enable_readback_passed_count']}",
        f"Wazuh 即時查詢授權={summary['wazuh_api_live_query_authorized_count']}",
        f"Wazuh 主動回應授權={summary['wazuh_active_response_authorized_count']}",
        f"主機寫入授權={summary['host_write_authorized_count']}",
        f"執行期閘門={summary['runtime_gate_count']}",
        "機密明文收集=false",
        "原始 Wazuh 載荷保存=false",
        "K8s secret 手動修改=false",
        "ArgoCD 手動同步=false",
        "Docker 重啟=false",
        "Nginx 或 gateway 繞路=false",
        "防火牆變更=false",
        "資安觀測節點主動掃描=false",
        "不是執行授權=true",
    ]


def _require_boundaries(payload: dict[str, Any]) -> None:
    summary = _summary(payload)
    for key in (
        "live_metadata_owner_response_accepted_count",
        "secret_source_metadata_accepted_count",
        "wazuh_manager_health_ref_accepted_count",
        "readonly_account_scope_accepted_count",
        "post_enable_readback_passed_count",
        "wazuh_api_live_query_authorized_count",
        "wazuh_active_response_authorized_count",
        "host_write_authorized_count",
        "runtime_gate_count",
    ):
        if _int(summary.get(key)) != 0:
            raise ValueError(f"Wazuh 即時中繼資料閘門 summary.{key} 必須維持 0")

    boundaries = payload.get("execution_boundaries")
    if not isinstance(boundaries, dict):
        raise ValueError("Wazuh 即時中繼資料閘門 execution_boundaries 缺失")
    for key in _REQUIRED_FALSE_BOUNDARIES:
        if boundaries.get(key) is not False:
            raise ValueError(f"Wazuh 即時中繼資料閘門 execution_boundaries.{key} 必須維持 false")
    if boundaries.get("not_authorization") is not True:
        raise ValueError("Wazuh 即時中繼資料閘門 not_authorization 必須維持 true")
