#!/usr/bin/env python3
"""Koncowa walidacja punktu 7: YAML, pozostale http://, nienaruszone HTTP_ONLY."""
import collections
import json
import os
import subprocess

import yaml

R = "/var/lib/pagan-sync/recipes"


def git(*a):
    return subprocess.run(["git", "-C", R] + list(a), capture_output=True, text=True).stdout


files = git("diff", "--name-only").split()
badyaml = []
for f in files:
    try:
        yaml.safe_load(open(f"{R}/{f}", newline="", encoding="utf-8"))
    except Exception as e:
        badyaml.append((f, e))
print(f"zmienionych plikow: {len(files)} | bledow YAML: {len(badyaml)}")
for f, e in badyaml[:10]:
    print("   !", f, e)

left = collections.Counter()
for dp, _d, fs in os.walk(R):
    if ".git" in dp or "PAGBUILD.yaml" not in fs:
        continue
    p = os.path.join(dp, "PAGBUILD.yaml")
    try:
        d = yaml.safe_load(open(p, newline="", encoding="utf-8")) or {}
    except Exception:
        continue
    for k in ("source", "sources", "url"):
        v = d.get(k)
        if v is None:
            continue
        for x in (v if isinstance(v, list) else [v]):
            if str(x).startswith("http://"):
                left[os.path.relpath(p, R)] += 1

audit = json.load(open("/tmp/https-audit.json"))
exp_left = (len(audit["HTTP_ONLY"]) + len(audit["BOTH_DEAD"])
            + len(audit["CONTENT_DIFF"]) + len(audit["UNRESOLVED"]))
print(f"\npozostale http://: {sum(left.values())} (oczekiwane ~{exp_left})")
print(f"   w tym plikow: {len(left)}")

# HTTP_ONLY: zaden nie moze byc https
broke = []
for i in audit["HTTP_ONLY"]:
    p = f"{R}/{i['recipe']}"
    try:
        d = yaml.safe_load(open(p, newline="", encoding="utf-8")) or {}
    except Exception:
        continue
    for k in ("source", "sources", "url"):
        v = d.get(k)
        if v is None:
            continue
        for x in (v if isinstance(v, list) else [v]):
            if str(x).startswith("https://") and str(x)[8:] == i["expanded"][7:]:
                broke.append((i["recipe"], str(x)))
print(f"HTTP_ONLY zmienione na https (ma byc 0): {len(broke)}")
for f, u in broke[:10]:
    print("   !", f, u)

# czy wszystkie z SAFE_* sa juz https
notconv = []
for cls in ("SAFE_HTTPS", "SAFE_HTTPS_UNVERIFIED"):
    for i in audit[cls]:
        p = f"{R}/{i['recipe']}"
        try:
            d = yaml.safe_load(open(p, newline="", encoding="utf-8")) or {}
        except Exception:
            continue
        found_http = False
        for k in ("source", "sources", "url"):
            v = d.get(k)
            if v is None:
                continue
            for x in (v if isinstance(v, list) else [v]):
                if str(x) == i["raw"]:
                    found_http = True
        if found_http:
            notconv.append((i["recipe"], i["raw"]))
print(f"SAFE_* ktore nadal sa http (ma byc 0): {len(notconv)}")
for f, u in notconv[:10]:
    print("   !", f, u)