#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Validate the remote-bound Phase-1.0BD policy commit."""

import argparse
import hashlib
import json
import subprocess
from pathlib import Path


def git(root: Path, *args: str) -> str:
    return subprocess.run(["git", *args], cwd=root, check=True,
                          capture_output=True, text=True).stdout.strip()


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    parser.add_argument("--retroarch-root", type=Path, required=True)
    args = parser.parse_args()
    data = json.loads((args.root / "manifests/retroarch/phase-1.0bd-dormant-sdl-materializer-policy.json").read_text(encoding="utf-8"))
    bind = data["source_bindings"]
    parent = args.root / "manifests/retroarch/phase-1.0bc-cross-build-prerequisite-audit.json"
    assert hashlib.sha256(parent.read_bytes()).hexdigest() == bind["phase10bc_manifest_sha256"]
    commit = bind["retroarch_commit"]
    assert git(args.retroarch_root, "rev-parse", "HEAD") == commit
    assert git(args.retroarch_root, "rev-parse", bind["remote_ref"]) == commit
    assert git(args.retroarch_root, "rev-parse", f"{commit}^") == bind["retroarch_parent_commit"]
    paths = {"makefile": "Makefile.ps5",
             "policy": "tools/phase10bd_sdl_materializer_policy.py",
             "validator": "tools/validate_ps5_phase10bd.py",
             "tests": "tests/test_ps5_phase10bd_materializer_policy.py",
             "source_doc": "docs/ps5-phase10bd-sdl-materializer-policy.md"}
    for key, source in paths.items():
        assert git(args.retroarch_root, "rev-parse", f"{commit}:{source}") == bind[f"{key}_blob"]
    assert data["authorizations"]["injected_adapter_source_authorized"]
    assert not data["authorizations"]["live_adapter_authorized"]
    assert not data["decision"]["materialization_allowed"]
    print("Phase-1.0BD dormant policy binding validation passed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())