"""Opt-in internal authentication only; ArtifactService retains durable attempt ownership."""
from dataclasses import dataclass, field
import os
from pathlib import Path
from urllib.parse import urlsplit


@dataclass(frozen=True, repr=False)
class RelayTransport:
    endpoint: str
    token: str = field(repr=False)

    @classmethod
    def from_environment(cls, endpoint, env=None):
        e=os.environ if env is None else env
        mode=e.get('CONTEXTRA_EVENT_TRANSPORT','direct')
        if mode=='direct':
            return None
        if mode!='sidecar':
            raise ValueError('EVENT_TRANSPORT_INVALID')
        p=urlsplit(endpoint)
        if (p.scheme!='http' or p.hostname!='ai-control-sidecar' or p.port!=8080
                or p.path!='/internal/events' or p.username or p.password or p.query or p.fragment):
            raise ValueError('EVENT_RELAY_ENDPOINT_INVALID')
        path=Path(e['CONTEXTRA_RELAY_TOKEN_FILE'])
        if not path.is_absolute() or path.is_symlink():
            raise ValueError('EVENT_RELAY_TOKEN_FILE_INVALID')
        with path.open('rb') as f:
            raw=f.read(8193)
        token=raw.decode('ascii').rstrip('\r\n')
        if not 16<=len(token)<=8192 or any(not 33<=ord(c)<=126 for c in token):
            raise ValueError('EVENT_RELAY_TOKEN_INVALID')
        return cls(endpoint,token)

    def post(self, body, send):
        # One existing ledger attempt -> one relay request -> at most one Manager Event POST.
        # No login, requeue, endpoint fallback or body reconstruction here.
        return send(self.endpoint,body,authorization='Bearer '+self.token)