#!/usr/bin/env python3
"""
SAFE DEFENSIVE VALIDATOR — PYTHON PACKAGE VERSION PROOF

Purpose: Confirms a vulnerable Python package (and exact version) is installed
         in the current environment or virtualenv using only read-only pip show
         and requirements file inspection. Never imports or executes the package.

Safety: Purely informational. Uses subprocess for "pip show" only.
        Cross-platform (Linux, macOS, Windows with Python).

Generated by Vigil safe-poc-generator (Phase 1, template A — defensive only).
"""

import argparse
import json
import subprocess
import sys
from datetime import datetime, timezone
from pathlib import Path

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--package", required=True)
    parser.add_argument("--version", default="")
    parser.add_argument("--root", default=".")
    args = parser.parse_args()

    started = datetime.now(timezone.utc).isoformat()
    root = Path(args.root).resolve()
    evidence = {
        "validator": "python-package-validator",
        "schemaVersion": "1.0.0",
        "generatedBy": "Vigil safe-poc-generator (Phase 1, template A)",
        "startedAt": started,
        "package": args.package,
        "requestedVersion": args.version,
        "root": str(root),
        "checks": [],
        "present": False,
        "conclusion": "",
    }

    # pip show (best effort)
    try:
        res = subprocess.run(
            [sys.executable, "-m", "pip", "show", args.package],
            capture_output=True, text=True, timeout=15
        )
        if res.returncode == 0:
            for line in res.stdout.splitlines():
                if line.lower().startswith("version:"):
                    ver = line.split(":", 1)[1].strip()
                    evidence["checks"].append({"type": "pip-show", "version": ver, "match": args.version in ver or not args.version})
                    if args.version in ver or not args.version:
                        evidence["present"] = True
    except Exception as e:
        evidence["checks"].append({"type": "pip-show", "error": str(e)[:200]})

    # requirements*.txt scan (lightweight)
    for req in root.glob("requirements*.txt"):
        try:
            txt = req.read_text(errors="ignore")
            if args.package.lower() in txt.lower():
                evidence["checks"].append({"type": "requirements-file", "file": str(req), "found": True})
                evidence["present"] = True
        except Exception:
            pass

    evidence["completedAt"] = datetime.now(timezone.utc).isoformat()
    evidence["conclusion"] = (
        f"CONFIRMED: {args.package} present (version match or any)." if evidence["present"]
        else f"{args.package} not found or not at vulnerable version in pip/requirements."
    )

    print(json.dumps(evidence, indent=2))
    sys.exit(0 if evidence["present"] else 1)

if __name__ == "__main__":
    main()