#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
from __future__ import annotations
import base64,hashlib,ipaddress,json,os,socket,time
from pathlib import Path
from phase10ds_metadata_protocol import MAX_WIRE,parse_stream
ARTIFACT_SIZE=109928;ARTIFACT_SHA256="077307b98e44f566fa1db82b08cd5e71bd56bd9792826fc7254965fa768c0dc7";PORT=9021
FIELDS={"active","run_id","target","port","artifact_size","artifact_sha256","output_path","receipt_path","not_before","not_after","one_connection","one_transfer","one_execution","result_receive","four_exact_metadata_reads","possible_atime_effect_acknowledged","app_pkg_read","backup_read","persistent_device_write","installation","autoload","retry","reconnect"}
class RunnerError(RuntimeError):pass
def load(path):
 v=json.loads(path.read_text(encoding="utf-8"))
 if not isinstance(v,dict):raise RunnerError("record object")
 return v
def validate(a,b,now):
 if set(a)!=FIELDS or set(b)!=FIELDS or a!=b:raise RunnerError("record mismatch")
 if a["active"] is not True or not a["not_before"]<=now<=a["not_after"]:raise RunnerError("inactive")
 if a["port"]!=PORT or a["artifact_size"]!=ARTIFACT_SIZE or a["artifact_sha256"]!=ARTIFACT_SHA256:raise RunnerError("identity")
 if any(a[k] is not True for k in ("one_connection","one_transfer","one_execution","result_receive","four_exact_metadata_reads","possible_atime_effect_acknowledged")):raise RunnerError("authority")
 if any(a[k] is not False for k in ("app_pkg_read","backup_read","persistent_device_write","installation","autoload","retry","reconnect")):raise RunnerError("forbidden")
 ipaddress.IPv4Address(a["target"])
 for key in ("output_path","receipt_path"):
  p=Path(a[key])
  if not p.is_absolute() or p.exists():raise RunnerError("exclusive path")
 return a
def exclusive(path,value):
 with path.open("x",encoding="utf-8",newline="\n") as f:json.dump(value,f,sort_keys=True);f.write("\n");f.flush();os.fsync(f.fileno())
def run(artifact,activation,approval,socket_factory=socket.socket,clock=time.monotonic,wall=time.time):
 p=validate(load(activation),load(approval),wall());raw=artifact.read_bytes()
 if len(raw)!=ARTIFACT_SIZE or hashlib.sha256(raw).hexdigest()!=ARTIFACT_SHA256:raise RunnerError("artifact")
 exclusive(Path(p["receipt_path"]),{"artifact_sha256":ARTIFACT_SHA256,"consumed_before_socket":True,"run_id":p["run_id"]});wire=bytearray();s=None;deadline=clock()+20
 try:
  s=socket_factory(socket.AF_INET,socket.SOCK_STREAM);s.settimeout(3);s.connect((p["target"],PORT));s.sendall(raw);s.shutdown(socket.SHUT_WR)
  while True:
   left=deadline-clock()
   if left<=0:raise RunnerError("deadline")
   s.settimeout(left);chunk=s.recv(min(4096,MAX_WIRE-len(wire)))
   if not chunk:break
   wire.extend(chunk)
   if len(wire)==MAX_WIRE:break
  files=parse_stream(bytes(wire));exclusive(Path(p["output_path"]),{"files":{k:{"base64":base64.b64encode(v).decode(),"sha256":hashlib.sha256(v).hexdigest(),"size":len(v)} for k,v in files.items()},"run_id":p["run_id"]});return files
 finally:
  for i in range(len(wire)):wire[i]=0
  if s is not None:s.close()