#!/usr/bin/env python3
import argparse, json, sys
from datetime import datetime
from pathlib import Path
BASE = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(BASE))
from sqlalchemy import select
from config.control_plane import get_control_plane_session
from bridge_platform.tenants.models import WordPressBridgeRelease

parser = argparse.ArgumentParser()
parser.add_argument("artifact")
parser.add_argument("release")
args = parser.parse_args()
artifact, release_path = Path(args.artifact).resolve(), Path(args.release).resolve()
data = json.loads(release_path.read_text(encoding="utf-8"))
content = artifact.read_bytes()
import hashlib
if artifact.name != data["artifact_name"] or len(content) != data["artifact_size"] or hashlib.sha256(content).hexdigest() != data["sha256"]:
    raise SystemExit("Bridge artifact metadata verification failed")
import base64
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
public_key = serialization.load_pem_public_key(Path("/var/www/html/.platform-signing/wordpress-bridge-ed25519.pub.pem").read_bytes())
if not isinstance(public_key, Ed25519PublicKey):
    raise SystemExit("Bridge verification key is invalid")
public_key.verify(base64.b64decode(data["signature"]), content)
with get_control_plane_session() as session:
    record = session.execute(select(WordPressBridgeRelease).where(WordPressBridgeRelease.version == data["version"])).scalar_one_or_none()
    if record is None:
        record = WordPressBridgeRelease(version=data["version"])
        session.add(record)
    record.channel = data["channel"]
    record.artifact_name = data["artifact_name"]
    record.artifact_path = str(artifact)
    record.artifact_size = data["artifact_size"]
    record.sha256 = data["sha256"]
    record.signature = data["signature"]
    record.status = "test"
    record.metadata_json = {key: data[key] for key in ("minimum_wordpress_version", "minimum_php_version", "release_notes", "security_update", "schema_version") if key in data}
    record.published_at = datetime.utcnow()
    session.commit()
print(json.dumps({"status": "registered", "version": data["version"]}))