#!/usr/bin/env python3
"""Refuse unverified Xcode package networking in the selected native dependency graph."""
from __future__ import annotations

import argparse
import json
from pathlib import Path
import sys

from native_project_graph import Refused, project, selected, workspace

REMEDIATION = ("Preserve source; use the vendor's official CocoaPods distribution and commit "
               "Podfile.lock, or verified local XCFrameworks; rerun the same task's build.")


def check(root: Path, container: str = "", *, before_pods: bool = False, initial_pods_lock: bool = False) -> dict:
    if initial_pods_lock and not before_pods:
        raise Refused("native_initial_lock_phase_required")
    root = root.resolve(strict=True)
    pending, visited, count = [selected(root, container, before_pods)], set(), 0
    while pending:
        path = pending.pop()
        if path in visited:
            continue
        visited.add(path)
        if len(visited) > 200:
            raise Refused("native_project_inventory_unverified")
        if path.suffix == ".xcworkspace":
            pending.extend(workspace(root, path, before_pods, initial_pods_lock))
        elif path.suffix == ".xcodeproj":
            pending.extend(project(root, path))
            count += 1
        else:
            raise Refused("native_workspace_reference_unverified")
    if not count:
        raise Refused("native_project_inventory_missing")
    return {"ok": True, "projects": count, "xcode_package_resolution": "unused",
            "phase": "before_pods" if before_pods else "complete"}


def main(argv: list[str]) -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("root", type=Path)
    parser.add_argument("--container", default="")
    parser.add_argument("--before-pods", action="store_true")
    parser.add_argument("--initial-pods-lock", action="store_true")
    args = parser.parse_args(argv)
    try:
        answer = check(args.root, args.container, before_pods=args.before_pods,
                       initial_pods_lock=args.initial_pods_lock)
    except (Refused, OSError) as exc:
        code = str(exc) if isinstance(exc, Refused) else "native_project_inventory_unverified"
        answer = {"ok": False, "code": code, "next": REMEDIATION}
    print(json.dumps(answer, sort_keys=True))
    return 0 if answer["ok"] else 1


if __name__ == "__main__":
    raise SystemExit(main(sys.argv[1:]))