#!/usr/bin/env python3
import hashlib
import json
import pathlib
import sys

import bpy


def state():
    scene = bpy.context.scene
    receipt = bpy.data.texts.get("WBV2-P6-001-ScriptingPolicyReceipt")
    malicious = bpy.data.texts.get("WBV2-P6-001-MaliciousScript")
    if receipt is None or malicious is None:
        raise RuntimeError("scripting policy fixture is missing receipt or source")
    return {
        "sceneId": "scene:" + scene.name,
        "receipt": json.loads(receipt.as_string()),
        "source": malicious.as_string(),
        "useModule": malicious.use_module,
    }


def main():
    arguments = sys.argv[sys.argv.index("--") + 1 :]
    if len(arguments) != 2:
        raise SystemExit("usage: blender -b --factory-startup --python check-wbv2-p6-001-desktop.py -- FIXTURE REPORT")
    fixture, output = (pathlib.Path(value).resolve() for value in arguments)
    bpy.ops.wm.open_mainfile(filepath=str(fixture), load_ui=False)
    before = state()
    temporary = fixture.with_name(f"{fixture.stem}-reopen.blend")
    try:
        bpy.ops.wm.save_as_mainfile(filepath=str(temporary), check_existing=False, compress=True)
        bpy.ops.wm.open_mainfile(filepath=str(temporary), load_ui=False)
        after = state()
    finally:
        temporary.unlink(missing_ok=True)
    if before != after:
        raise RuntimeError(f"scripting policy save/reopen drift: {before} != {after}")
    policy = after["receipt"]
    if policy["defaults"] != {"addonInstall": False, "autorun": False, "driverExpressions": False, "module": False, "network": False}:
        raise RuntimeError("scripting policy defaults are not deny-by-default")
    if policy["boundaries"] != {"filesystemEscape": "BLOCKED", "network": "BLOCKED", "secretAccess": "BLOCKED"}:
        raise RuntimeError("scripting policy boundaries are not blocked")
    report = {
        "schemaVersion": 1,
        "task": "WBV2-P6-001",
        "operation": "SECURITY_SCRIPTING_DESKTOP_METADATA",
        "fixtureSha256": hashlib.sha256(fixture.read_bytes()).hexdigest(),
        "state": after,
        "execution": "DISABLED",
        "saveReopen": "EXACT",
        "blenderVersion": bpy.app.version_string,
    }
    output.parent.mkdir(parents=True, exist_ok=True)
    output.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n", encoding="utf-8")
    print("wbv2-p6-001-desktop-ok defaults=deny sandbox=disabled boundaries=blocked saveReopen=exact")


if __name__ == "__main__":
    main()