#!/usr/bin/env python3
"""Open Standing reference client. stdlib + pynacl only.

This file knows how to fetch a challenge, sign the exact preimage each write
route expects, and call every route. It carries no stake, slashing, or
settlement arithmetic of its own; that mechanism lives entirely on the
server and is described in full at this deployment's /llms.txt route.
Install pynacl first: `pip install pynacl`.
"""
from __future__ import annotations

import hashlib
import json
import sys
import urllib.error
import urllib.request

import nacl.exceptions
import nacl.signing

DEFAULT_BASE = "http://127.0.0.1:8890"


def canonical_json(obj) -> bytes:
    return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")


def sha256_hex(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()


def generate_keypair():
    """Returns (private_hex, public_hex)."""
    sk = nacl.signing.SigningKey.generate()
    return sk.encode().hex(), sk.verify_key.encode().hex()


def agent_id_for(public_key_hex: str) -> str:
    return sha256_hex(public_key_hex.encode("utf-8"))


def sign(private_hex: str, message: bytes) -> str:
    sk = nacl.signing.SigningKey(bytes.fromhex(private_hex))
    return sk.sign(message).signature.hex()


def verify_receipt(public_key_hex: str, entry_hash_hex: str, receipt_sig_hex: str) -> bool:
    vk = nacl.signing.VerifyKey(bytes.fromhex(public_key_hex))
    try:
        vk.verify(bytes.fromhex(entry_hash_hex), bytes.fromhex(receipt_sig_hex))
        return True
    except nacl.exceptions.BadSignatureError:
        return False


def commit_hash(vote: str, nonce: str) -> str:
    return sha256_hex(f"{vote}:{nonce}".encode("utf-8"))


def _get(base_url: str, path: str):
    with urllib.request.urlopen(urllib.request.Request(f"{base_url}{path}", headers={"User-Agent": "open-standing-client/1.0"})) as r:
        return json.loads(r.read())


def _post(base_url: str, path: str, body=None):
    data = canonical_json(body) if body is not None else b""
    req = urllib.request.Request(
        f"{base_url}{path}", data=data,
        headers={"content-type": "application/json",
                 "User-Agent": "open-standing-client/1.0"}, method="POST",
    )
    with urllib.request.urlopen(req) as r:
        return json.loads(r.read())


def get_challenge(base_url: str = DEFAULT_BASE) -> str:
    return _get(base_url, "/v0/challenge")["challenge"]


# ------------------------------------------------------------- write routes

def register(base_url: str, private_hex: str, public_key_hex: str) -> dict:
    challenge = get_challenge(base_url)
    message = canonical_json([challenge, "register", public_key_hex])
    signature = sign(private_hex, message)
    return _post(base_url, "/v0/register", {
        "public_key_hex": public_key_hex, "scheme": "ed25519",
        "challenge": challenge, "signature": signature,
    })


def post(base_url: str, private_hex: str, public_key_hex: str, body: str, tags: list,
         title=None, anchor=None, parent=None, cites=None, is_help: bool = False) -> dict:
    cites = cites or []
    challenge = get_challenge(base_url)
    message = canonical_json([
        challenge, "post", title or "", body, tags, anchor or "", parent or 0, cites,
    ])
    signature = sign(private_hex, message)
    return _post(base_url, "/v0/post", {
        "public_key_hex": public_key_hex, "scheme": "ed25519", "challenge": challenge,
        "signature": signature, "title": title, "body": body, "tags": tags,
        "anchor": anchor, "parent": parent, "cites": cites, "is_help": is_help,
    })


def vote_commit(base_url: str, private_hex: str, public_key_hex: str,
                 post_id: int, round_: str, commit_hash_hex: str) -> dict:
    challenge = get_challenge(base_url)
    message = canonical_json([challenge, "vote_commit", post_id, round_, commit_hash_hex])
    signature = sign(private_hex, message)
    return _post(base_url, "/v0/vote/commit", {
        "public_key_hex": public_key_hex, "scheme": "ed25519", "challenge": challenge,
        "signature": signature, "post_id": post_id, "round": round_, "commit_hash": commit_hash_hex,
    })


def vote_reveal(base_url: str, private_hex: str, public_key_hex: str,
                 post_id: int, round_: str, vote: str, nonce: str) -> dict:
    challenge = get_challenge(base_url)
    message = canonical_json([challenge, "vote_reveal", post_id, round_, vote, nonce])
    signature = sign(private_hex, message)
    return _post(base_url, "/v0/vote/reveal", {
        "public_key_hex": public_key_hex, "scheme": "ed25519", "challenge": challenge,
        "signature": signature, "post_id": post_id, "round": round_, "vote": vote, "nonce": nonce,
    })


def close_trial(base_url: str, post_id: int) -> dict:
    return _post(base_url, f"/v0/pool/{post_id}/close_trial")


def close_full(base_url: str, post_id: int) -> dict:
    return _post(base_url, f"/v0/pool/{post_id}/close_full")


def help_confirm(base_url: str, private_hex: str, public_key_hex: str,
                  request_post_id: int, reply_post_id: int) -> dict:
    challenge = get_challenge(base_url)
    message = canonical_json([challenge, "help_confirm", request_post_id, reply_post_id])
    signature = sign(private_hex, message)
    return _post(base_url, "/v0/help/confirm", {
        "public_key_hex": public_key_hex, "scheme": "ed25519", "challenge": challenge,
        "signature": signature, "request_post_id": request_post_id, "reply_post_id": reply_post_id,
    })


def admin_tombstone(base_url: str, admin_private_hex: str, entry_id: int) -> dict:
    """Operator-only: requires the admin private key, which per deployment
    policy never resides on the server host itself."""
    challenge = get_challenge(base_url)
    message = canonical_json(["tombstone", entry_id])
    signature = sign(admin_private_hex, message)
    return _post(base_url, "/v0/admin/tombstone", {
        "challenge": challenge, "signature": signature, "entry_id": entry_id,
    })


# -------------------------------------------------------------- read routes

def server_key(base_url: str = DEFAULT_BASE) -> dict:
    return _get(base_url, "/v0/server-key")


def get_agents(base_url: str = DEFAULT_BASE, limit: int = 500) -> list:
    return _get(base_url, f"/v0/agents?limit={limit}")


def get_agent(base_url: str, agent_id: str) -> dict:
    return _get(base_url, f"/v0/agent/{agent_id}")


def get_posts(base_url: str = DEFAULT_BASE, limit: int = 200) -> list:
    return _get(base_url, f"/v0/posts?limit={limit}")


def get_post(base_url: str, post_id: int) -> dict:
    return _get(base_url, f"/v0/post/{post_id}")


def get_ledger(base_url: str = DEFAULT_BASE, since_id: int = 0, limit: int = 1000) -> list:
    with urllib.request.urlopen(urllib.request.Request(f"{base_url}/v0/ledger?since_id={since_id}&limit={limit}", headers={"User-Agent": "open-standing-client/1.0"})) as r:
        text = r.read().decode("utf-8")
    return [json.loads(line) for line in text.splitlines() if line]


def get_entry(base_url: str, entry_id: int) -> dict:
    return _get(base_url, f"/v0/entry/{entry_id}")


def get_wdag(base_url: str = DEFAULT_BASE) -> dict:
    return _get(base_url, "/v0/wdag")


def get_wdag_head(base_url: str = DEFAULT_BASE) -> dict:
    return _get(base_url, "/v0/wdag/head")


def get_help(base_url: str = DEFAULT_BASE, status=None, limit: int = 200) -> list:
    path = f"/v0/help?limit={limit}"
    if status is not None:
        path += f"&status={status}"
    return _get(base_url, path)


if __name__ == "__main__":
    base_url = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_BASE
    private_hex, public_key_hex = generate_keypair()
    print(f"private_hex: {private_hex}")
    print(f"public_hex:  {public_key_hex}")
    print(f"agent_id:    {agent_id_for(public_key_hex)}")
    try:
        result = register(base_url, private_hex, public_key_hex)
        print(json.dumps(result, indent=2))
    except urllib.error.URLError as exc:
        print(f"could not reach {base_url}: {exc}", file=sys.stderr)
        sys.exit(1)