#!/usr/bin/env python3
"""
validate-coo.py -- Targeted re-validation of the coo identity.

Verifies the get_totp exact-name fix: fresh login with password + TOTP.

Usage:
    docker compose run --rm --entrypoint python3 provision validate-coo.py
"""

import os
import sys

from playwright.sync_api import sync_playwright

sys.path.insert(0, os.path.dirname(__file__))
from bw_helper import BitwardenHelper

CLOUDRON_BASE = "https://my.knownelement.com"
ITEM = "coo Cloudron"
EMAIL = "tsgstaff-coo@turnsys.com"


def main():
    bw = BitwardenHelper(
        client_id=os.environ["BW_CLIENTID"],
        client_secret=os.environ["BW_CLIENTSECRET"],
        password=os.environ["BW_PASSWORD"],
        server_url=os.environ.get("BW_SERVER", ""),
    )
    bw.login()
    password = bw.get_item_password(ITEM)

    with sync_playwright() as p:
        browser = p.chromium.launch(headless=True)
        context = browser.new_context(viewport={"width": 1280, "height": 1024})
        page = context.new_page()

        page.goto(f"{CLOUDRON_BASE}/login.html", wait_until="domcontentloaded", timeout=30000)
        page.wait_for_timeout(1500)
        page.wait_for_selector("#inputPassword", timeout=15000)
        page.click("#inputUsername")
        page.keyboard.type(EMAIL)
        page.click("#inputPassword")
        page.keyboard.type(password)
        page.locator('[role="button"]:has-text("Log in")').first.click()
        page.wait_for_timeout(4000)

        totp_el = page.query_selector("#inputTotpToken")
        if totp_el and totp_el.is_visible():
            print("2FA prompt: YES")
            code = bw.get_totp(ITEM)
            print(f"TOTP resolved by exact name: {code}")
            totp_el.click()
            page.keyboard.type(code)
            page.locator("#totpTokenSubmitButton").click()
            page.wait_for_timeout(5000)
        else:
            print("2FA prompt: NO (problem)")

        authed = ("login" not in page.url.lower()
                  and "openid" not in page.url.lower()
                  and "setupaccount" not in page.url.lower())
        print(f"coo login: {'PASS' if authed else 'FAIL'} ({page.url})")
        sys.exit(0 if authed else 1)


if __name__ == "__main__":
    main()