import base64
import json
from pathlib import Path
import shlex
import stat
import subprocess

SECRET = Path('/run/contextra-icerti-sudo.4nlWwu/password')
SSH = ['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '-o', 'StrictHostKeyChecking=yes',
       '-o', 'HostKeyAlias=[58.233.207.31]:1023', '-o', 'UserKnownHostsFile=/root/.ssh/contextra_icerti_known_hosts',
       '-i', '/root/.ssh/ltb1021_contextra_icerti_si_ed25519', '-p', '1023', 'si@192.168.50.7']


def root(script, timeout=120):
    info = SECRET.lstat()
    assert stat.S_ISREG(info.st_mode) and info.st_uid == 0 and not info.st_mode & 0o077
    assert not SECRET.is_symlink() and info.st_size < 8192
    secret = SECRET.read_bytes()
    encoded = base64.b64encode(script.encode()).decode()
    command = 'sudo -S -p "" python3 -c ' + shlex.quote("import base64;exec(base64.b64decode('" + encoded + "'))")
    result = subprocess.run(SSH + [command], input=secret, capture_output=True, timeout=timeout)
    value = secret.decode().strip()
    stdout = result.stdout.decode(errors='replace').replace(value, '<redacted>')
    stderr = result.stderr.decode(errors='replace').replace(value, '<redacted>')
    if result.returncode:
        raise RuntimeError(f'remote code={result.returncode}: {stderr[:1500]} {stdout[:1500]}')
    return stdout


if __name__ == '__main__':
    import sys
    print(root(Path(sys.argv[1]).read_text(), int(sys.argv[2]) if len(sys.argv) > 2 else 120))