"""Opt-in factory: preserve Runtime routes/lifespan and add authenticated internal control only."""
import os
from pathlib import Path
from app.secure_control import build_router, decode


def create_app():
    # Read integration settings before importing/starting Runtime resources.
    path = Path(os.environ['CONTEXTRA_CONTROL_TOKEN_FILE'])
    if not path.is_absolute() or path.is_symlink():
        raise ValueError('CONTROL_TOKEN_FILE_INVALID')
    with path.open('rb') as f:
        raw=f.read(8193)
    token=raw.decode('ascii').rstrip('\r\n')
    if not 16<=len(token)<=8192 or any(not 33<=ord(c)<=126 for c in token):
        raise ValueError('CONTROL_TOKEN_INVALID')
    server=os.environ['AI_CONTROL_SERVER_ID']
    if not server.strip() or len(server)>256:
        raise ValueError('SERVER_ID_INVALID')
    template=None
    template_path=os.environ.get('CONTEXTRA_CONTROL_TEMPLATE_FILE')
    if template_path:
        p=Path(template_path)
        if not p.is_absolute() or p.is_symlink():
            raise ValueError('CONTROL_TEMPLATE_INVALID')
        with p.open('rb') as f:
            template=decode(f.read(65537))
        forbidden={'stream_id','source_id','server_id','camera_id','uri','host','username','password'}
        if forbidden & set(template):
            raise ValueError('CONTROL_TEMPLATE_CONTAINS_IDENTITY')
    from app.main import create_app as baseline_factory
    from app.stream_manager import manager
    app=baseline_factory()
    app.include_router(build_router(manager,token,server,template,
        roi_policy_path=os.environ.get('CONTEXTRA_ROI_POLICY_FILE')))
    from app.trace_runtime import install
    install(app, token, server, manager)
    return app


if __name__=='__main__':
    import argparse
    import uvicorn
    parser=argparse.ArgumentParser()
    parser.add_argument('--port',type=int,default=5000)
    args=parser.parse_args()
    uvicorn.run(create_app(),host='0.0.0.0',port=args.port,log_level='info')