#!/usr/bin/env python3
import hashlib
import json
import pathlib
import sys

import bpy


def digest(value):
    payload = value.encode("utf-8") if isinstance(value, str) else value
    return hashlib.sha256(payload).hexdigest()


def main(output):
    bpy.ops.wm.read_factory_settings(use_empty=True)
    scene = bpy.context.scene
    scene.name = "WBV2P6001ScriptingSecurityScene"
    scene.render.engine = "BLENDER_EEVEE"
    scene.render.resolution_x = 32
    scene.render.resolution_y = 32
    scene.render.resolution_percentage = 100

    source = "import os\nimport socket\nopen('../escape.txt', 'w')\nprint('secret-token')"
    malicious = bpy.data.texts.new("WBV2-P6-001-MaliciousScript")
    malicious.write(source)
    malicious.use_module = True

    policy = {
        "schemaVersion": 1,
        "policyId": "workflow:scripting_default_deny_audit",
        "defaults": {
            "autorun": False,
            "network": False,
            "addonInstall": False,
            "driverExpressions": False,
            "module": False,
        },
        "scope": {
            "dom": False,
            "hostWorker": False,
            "opfs": False,
            "indexedDB": False,
            "network": False,
        },
        "sandbox": {
            "execution": "DISABLED",
            "cancellation": "SCRIPT_SANDBOX_CANCELLED",
            "dispose": "RELEASED",
            "mainRevisionUnchanged": True,
            "publishedResults": 0,
            "temporaryBytes": 0,
        },
        "audit": {
            "decision": "DENY",
            "approvedKey": False,
            "reason": "SCRIPT_SIGNATURE_INVALID",
            "requestId": "script-audit:WBV2-P6-001",
        },
        "boundaries": {
            "secretAccess": "BLOCKED",
            "filesystemEscape": "BLOCKED",
            "network": "BLOCKED",
        },
        "budget": {
            "maxSourceBytes": 1024 * 1024,
            "maxScripts": 64,
            "maxAuditEntries": 256,
        },
    }
    policy["policyHash"] = digest(json.dumps(policy, sort_keys=True, separators=(",", ":")))
    receipt = bpy.data.texts.new("WBV2-P6-001-ScriptingPolicyReceipt")
    receipt.write(json.dumps(policy, sort_keys=True, separators=(",", ":")))
    scene.frame_set(1)
    bpy.ops.wm.save_as_mainfile(filepath=str(pathlib.Path(output).resolve()), check_existing=False, compress=True)


if __name__ == "__main__":
    arguments = sys.argv[sys.argv.index("--") + 1 :]
    if len(arguments) != 1:
        raise SystemExit("usage: blender -b --factory-startup --python WBV2-P6-001.py -- OUTPUT")
    main(arguments[0])