"""Fail-closed document-original availability shared by V5 metadata and streaming."""
from __future__ import annotations

import errno
import os
import stat
from dataclasses import dataclass
from pathlib import Path
from typing import Callable

MAX_ORIGINAL_BYTES = 20 * 1024 * 1024
ORIGINAL_MIME_MAGIC = (
    (b"%PDF-", "application/pdf", ".pdf"),
    (b"\x89PNG\r\n\x1a\n", "image/png", ".png"),
    (b"\xff\xd8\xff", "image/jpeg", ".jpg"),
)


@dataclass(frozen=True)
class OriginalProbe:
    status: str
    descriptor: int | None = None
    size: int = 0
    mime: str = ""
    download_name: str = ""

    def close(self) -> None:
        if self.descriptor is not None:
            os.close(self.descriptor)


def configured_original_roots() -> tuple[Path, ...]:
    raw = os.environ.get("HEALTH_DASHBOARD_ORIGINAL_ROOTS", "").strip()
    if not raw:
        base = Path.home() / ".hermes" / "assets" / "Gesundheit"
        return (base.absolute(), (base / "reports").absolute())
    roots: list[Path] = []
    for value in raw.split(os.pathsep):
        candidate = Path(value)
        if not candidate.is_absolute() or not candidate.exists() or not candidate.is_dir():
            raise RuntimeError("invalid HEALTH_DASHBOARD_ORIGINAL_ROOTS")
        absolute = candidate.absolute()
        if absolute.resolve() != absolute:
            raise RuntimeError("original root must not be a symlink")
        roots.append(absolute)
    if not roots or len(set(roots)) != len(roots):
        raise RuntimeError("invalid HEALTH_DASHBOARD_ORIGINAL_ROOTS")
    return tuple(roots)


def _open_regular_beneath(root: Path, candidate: Path) -> int:
    try:
        relative = candidate.absolute().relative_to(root.absolute())
    except ValueError as error:
        raise OSError(errno.EPERM, "outside_root") from error
    if not relative.parts or any(part in {"", ".", ".."} for part in relative.parts):
        raise OSError(errno.EPERM, "invalid_path")
    directory = os.open(root, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
    try:
        for part in relative.parts[:-1]:
            child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=directory)
            os.close(directory)
            directory = child
        return os.open(relative.parts[-1], os.O_RDONLY | os.O_NOFOLLOW | getattr(os, "O_NONBLOCK", 0), dir_fd=directory)
    finally:
        os.close(directory)


def probe_original(
    raw_path: object,
    *,
    reviewed: bool,
    roots: tuple[Path, ...] | None = None,
    max_bytes: int = MAX_ORIGINAL_BYTES,
    opener: Callable[[Path, Path], int] = _open_regular_beneath,
) -> OriginalProbe:
    if not reviewed:
        return OriginalProbe("not_reviewed")
    if not raw_path or "\x00" in str(raw_path):
        return OriginalProbe("missing")
    allowed_roots = roots or configured_original_roots()
    raw = Path(str(raw_path)).expanduser()
    candidates = (raw,) if raw.is_absolute() else tuple(root / raw for root in allowed_roots)
    saw_blocked = False
    saw_missing = False
    descriptor: int | None = None
    for candidate in candidates:
        for root in allowed_roots:
            try:
                descriptor = opener(root, candidate)
                break
            except OSError as error:
                if error.errno in {errno.ENOENT}:
                    saw_missing = True
                else:
                    saw_blocked = True
        if descriptor is not None:
            break
    if descriptor is None:
        return OriginalProbe("blocked" if saw_blocked else "missing" if saw_missing else "blocked")
    try:
        metadata = os.fstat(descriptor)
        if not stat.S_ISREG(metadata.st_mode) or metadata.st_size > max_bytes:
            os.close(descriptor)
            return OriginalProbe("blocked")
        magic = os.read(descriptor, 16)
        os.lseek(descriptor, 0, os.SEEK_SET)
        for prefix, mime, suffix in ORIGINAL_MIME_MAGIC:
            if magic.startswith(prefix):
                return OriginalProbe("available", descriptor, metadata.st_size, mime, f"document{suffix}")
        os.close(descriptor)
        return OriginalProbe("unsupported")
    except OSError:
        os.close(descriptor)
        return OriginalProbe("blocked")