import json
import os
from pathlib import Path
import ssl
import subprocess
import urllib.request
import urllib.error

os.umask(0o077);ROOT=Path(__file__).parent
def cmd(args):return subprocess.run(args,check=True,capture_output=True,text=True,timeout=20).stdout
sql="SELECT relative_path FROM contextra_event_artifacts WHERE artifact_state='READY' AND media->'clip' IS NOT NULL ORDER BY created_at DESC LIMIT 1"
relative=cmd(['docker','exec','contextra-postgresql-1','sh','-c',
    'exec psql -X -qAt -U "$POSTGRES_USER" -d "$POSTGRES_DB" -c "$1"','sh',sql]).strip()
assert relative and '\n' not in relative
path='/artifacts/'+relative+'/clip.mp4'
base='https://192.168.50.221:38443'
ca='/workspace/contextra-runtime-config/secure-bridge/manager-ca.crt'
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),urllib.request.HTTPSHandler(context=ssl.create_default_context(cafile=ca)))
def request(path,method='GET',headers=None):
    req=urllib.request.Request(base+path,method=method,headers=headers or {},data=b'{}' if method=='POST' else None)
    try:
        with opener.open(req,timeout=5) as r:return dict(status=r.status,bytes=len(r.read(1024) if method!='HEAD' else b''),range=r.headers.get('Content-Range'))
    except urllib.error.HTTPError as e:return dict(status=e.code)
results=dict(head=request(path,'HEAD'),get=request(path),range=request(path,headers={'Range':'bytes=0-31'}),
    event_json=request(path.replace('clip.mp4','event.json')),listing=request('/artifacts/'),
    staging=request('/artifacts/.staging/x/clip.mp4'),readme=request('/artifacts/README.ko.md'),
    start_unauthorized=request('/api/v1/cameras/start','POST'),stop_unauthorized=request('/api/v1/cameras/stop','POST'))
assert results['head']['status']==200 and results['get']['status']==200 and results['range']['status']==206,results
assert results['range']['bytes']==32
assert all(results[k]['status']==404 for k in ('event_json','listing','staging','readme'))
assert all(results[k]['status']==401 for k in ('start_unauthorized','stop_unauthorized'))
# Existing Sidecar network namespace is outside the permitted LAN. TLS is still verified.
script="""
import json,ssl,urllib.request,urllib.error,sys
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),urllib.request.HTTPSHandler(context=ssl.create_default_context(cafile='/run/bridge/manager-ca.crt')))
out=[]
for headers in ({},{'Authorization':'Bearer non-secret-test','X-Forwarded-For':'192.168.50.101','X-Real-IP':'192.168.50.101'}):
 try:
  with opener.open(urllib.request.Request(sys.argv[1],method='HEAD',headers=headers),timeout=5) as r:out.append(r.status)
 except urllib.error.HTTPError as e:out.append(e.code)
print(json.dumps(out))
"""
outside=json.loads(cmd(['docker','exec','contextra-ai-control-sidecar-1','python3','-c',script,base+path]))
assert outside==[403,403],outside
results.update(outside_lan_docker_namespace=outside,external_internet_test=False,tls_verified=True,path=path)
with (ROOT/'verification.json').open('x') as out:json.dump(results,out,indent=2)
print(json.dumps({k:v for k,v in results.items() if k!='path'}))