#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Validate Phase-1.0DC identities and inactive policy."""
from __future__ import annotations
import argparse,ast,hashlib,json
from pathlib import Path

SOURCE=(6096,"b8e965f343a0c3df5cf7026b68f547a81dad08d4b2e0934e4f9721de8b99010f")
TESTS=(2630,"ecef8f126e2245d707a776b4fd02aad13553e6e79515287e1002d2855a8db2d2")
NETWORK={"socket","select","selectors","subprocess","urllib","http","requests"}
def exact(path,identity):
 data=path.read_bytes();return (len(data),hashlib.sha256(data).hexdigest())==identity
def errors(record,root=None):
 out=[];activation=record.get("activation",{})
 if record.get("status")!="INACTIVE_DUAL_ARTIFACT_BIGAPP_GATE_COMPLETE_TARGET_IMPLEMENTATION_BLOCKED":out.append("status")
 if activation.get("active") is not False or any(value is not None for key,value in activation.items() if key!="active"):out.append("activation")
 if any(record.get("authorizations",{}).values()):out.append("authorization")
 if any(record.get("implementation_boundary",{}).values()):out.append("implementation")
 c=record.get("candidate_contract",{})
 if c.get("exact_payload_sha256")!="8dadce9d9faaef21ea129a3d216c768eea9a3ca9bf8ecb8d852e376b58a9bf95" or c.get("fixed_existing_title")!="PPSA01659" or c.get("sole_cleanup_terminal")!="D14":out.append("candidate")
 if not all(record.get("forbidden_effects",{}).values()):out.append("forbidden")
 if record.get("decision")!={"host_gate_contract_complete":True,"candidate_can_currently_pass":False,"target_implementation_allowed":False,"device_action_allowed":False,"next_step":"OFFLINE_MINIMAL_LAUNCHER_SOURCE_PREREQUISITE_CLOSURE"}:out.append("decision")
 if root:
  source=root/"tools/phase10dc_bigapp_gate_contract.py";tests=root/"tests/test_phase10dc_bigapp_gate_contract.py"
  if not exact(source,SOURCE):out.append("source identity")
  if not exact(tests,TESTS):out.append("test identity")
  tree=ast.parse(source.read_text());imports={a.name.split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.Import) for a in n.names}|{(n.module or '').split('.')[0] for n in ast.walk(tree) if isinstance(n,ast.ImportFrom)}
  if imports&NETWORK:out.append("network import")
 return out
def main():
 p=argparse.ArgumentParser();p.add_argument("--root",type=Path,required=True);root=p.parse_args().root.resolve();record=json.loads((root/"manifests/retroarch/phase-1.0dc-inactive-bigapp-comparison-gate.json").read_text());found=errors(record,root)
 for item in found:print("ERROR:",item)
 if found:return 1
 print("Phase-1.0DC inactive BigApp gate validation passed");return 0
if __name__=="__main__":raise SystemExit(main())