#!/usr/bin/env python3
"""Audit workspace dependencies, licensing, and source inventory."""

from __future__ import annotations

import hashlib
import sys
import tomllib
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
EXPECTED_LICENSE_SHA256 = "0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0"


def fail(message: str) -> None:
    print(f"FAIL: {message}", file=sys.stderr)
    raise SystemExit(1)


def load(path: Path) -> dict:
    with path.open("rb") as stream:
        return tomllib.load(stream)


def main() -> None:
    workspace = load(ROOT / "Cargo.toml")
    package_defaults = workspace["workspace"]["package"]
    if package_defaults.get("license") != "AGPL-3.0-or-later":
        fail("workspace package license is not AGPL-3.0-or-later")
    if package_defaults.get("publish") is not False:
        fail("private workspace packages must set publish = false")
    if "repository" in package_defaults:
        fail("private scaffold must not advertise a placeholder repository URL")

    cli_manifest = load(ROOT / "crates" / "kiln-cli" / "Cargo.toml")
    core_dependency = cli_manifest.get("dependencies", {}).get("kiln-core", {})
    if core_dependency.get("version") != "=0.0.1":
        fail("internal kiln-core dependency must use the exact workspace release version")
    if core_dependency.get("path") != "../kiln-core":
        fail("internal kiln-core dependency must resolve through the reviewed workspace path")

    license_hash = hashlib.sha256((ROOT / "LICENSE").read_bytes()).hexdigest()
    if license_hash != EXPECTED_LICENSE_SHA256:
        fail(f"root LICENSE is not the canonical AGPL-3.0 text: {license_hash}")

    inventory = load(ROOT / "docs" / "phase-0" / "source-inventory.toml")
    components = {item["name"]: item for item in inventory["components"]}
    toolchain = load(ROOT / "rust-toolchain.toml")["toolchain"]["channel"]
    if components.get("rust", {}).get("version") != toolchain:
        fail("source inventory Rust version does not match rust-toolchain.toml")
    if components.get("cargo-deny", {}).get("version") != "0.20.2":
        fail("cargo-deny is absent or not pinned to the reviewed version")

    core_manifest = load(ROOT / "crates" / "kiln-core" / "Cargo.toml")
    expected_dependencies = {
        "serde": "=1.0.228",
        "serde_json": "=1.0.150",
        "uuid": "=1.24.0",
    }
    dependencies = core_manifest.get("dependencies", {})
    for name, version in expected_dependencies.items():
        configured = dependencies.get(name, {})
        configured_version = configured if isinstance(configured, str) else configured.get("version")
        if configured_version != version:
            fail(f"{name} must remain pinned to reviewed version {version}")
        if components.get(name, {}).get("version") != version.removeprefix("="):
            fail(f"{name} source inventory does not match its manifest version")

    lock = load(ROOT / "Cargo.lock")
    external = [package for package in lock["package"] if "source" in package]
    unexpected_sources = [
        f"{item['name']}@{item['version']}"
        for item in external
        if item["source"] != "registry+https://github.com/rust-lang/crates.io-index"
    ]
    if unexpected_sources:
        fail(f"unreviewed external Rust sources entered the workspace: {unexpected_sources}")

    load(ROOT / "deny.toml")
    print("PASS: workspace dependency, license, and source baseline")


if __name__ == "__main__":
    main()