import base64
import json
import os
from pathlib import Path
import stat
import subprocess
import sys

HERE = Path(__file__).parent
SECRET = Path('/run/contextra-icerti-sudo.Ws4qBy/password')
SSH = ['ssh', '-i', '/root/.ssh/ltb1021_contextra_icerti_si_ed25519', '-p', '1023',
       '-o', 'UserKnownHostsFile=/root/.ssh/contextra_icerti_known_hosts',
       '-o', 'StrictHostKeyChecking=yes', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=10',
       'si@58.233.207.31']

def remote(script, timeout=60):
    for path, mode in ((SECRET.parent, 0o700), (SECRET, 0o600)):
        s = path.lstat()
        assert not stat.S_ISLNK(s.st_mode) and s.st_uid == 0 and stat.S_IMODE(s.st_mode) == mode
    encoded = base64.b64encode(script.encode()).decode()
    command = "sudo -S -p '' python3 -B -c \"import base64,os;os.close(0);exec(base64.b64decode('%s'))\"" % encoded
    result = subprocess.run(SSH + [command], input=SECRET.read_bytes(), capture_output=True, timeout=timeout)
    if result.returncode:
        raise RuntimeError('REMOTE_FAILED rc=%s: %s' % (result.returncode, result.stderr.decode()[-1800:]))
    return result.stdout.decode()

if __name__ == '__main__':
    os.umask(0o077)
    print(remote(Path(sys.argv[1]).read_text(), int(sys.argv[2]) if len(sys.argv)>2 else 60))