"""Inert-until-pipe-input, one-request stdlib HTTPS worker. No custody authority.

Invoked only by the contained transport parent. No environment/CLI request
configuration, retries, redirects, proxy discovery, credential files or logs.
DNS/TLS/read socket timeouts are secondary; the owning process enforces abort.
"""
from __future__ import annotations

import json
import ssl
import struct
import sys
from urllib.error import HTTPError
from urllib.parse import urlsplit
from urllib.request import HTTPSHandler, HTTPRedirectHandler, ProxyHandler, Request, build_opener

INPUT_MAX = 65536
BODY_MAX = 1048576
META_MAX = 8192
SCHEMA = "concresca.deadline_ipc.v1"
ORIGIN = "https://concresca.com"


def _pairs(items):
    out = {}
    for key, value in items:
        if key in out:
            raise ValueError()
        out[key] = value
    return out


def _json(raw):
    value = json.loads(raw.decode("utf-8"), object_pairs_hook=_pairs,
                       parse_constant=lambda _: (_ for _ in ()).throw(ValueError()))
    json.dumps(value, ensure_ascii=False, allow_nan=False).encode("utf-8")
    return value


def _read(stream, count):
    out = bytearray()
    while len(out) < count:
        part = stream.read(count - len(out))
        if not part:
            raise ValueError()
        out.extend(part)
    return bytes(out)


def read_request(stream):
    length = struct.unpack("!I", _read(stream, 4))[0]
    if not 0 < length <= INPUT_MAX:
        raise ValueError()
    value = _json(_read(stream, length))
    if stream.read(1) or type(value) is not dict or set(value) != {"schemaVersion", "url", "method", "headers", "body", "socketTimeoutMilliseconds"}:
        raise ValueError()
    if value["schemaVersion"] != SCHEMA or value["method"] not in ("GET", "POST"):
        raise ValueError()
    url = value["url"]
    if type(url) is not str or len(url) > 4096 or any(ord(c) <= 32 or ord(c) >= 127 for c in url) or "\\" in url:
        raise ValueError()
    parsed = urlsplit(url)
    if (parsed.scheme != "https" or parsed.netloc != "concresca.com" or parsed.fragment
            or not parsed.path.startswith("/api/matm/commons/") or "%" in parsed.path
            or "//" in parsed.path or any(part in (".", "..") for part in parsed.path.split("/"))):
        raise ValueError()
    headers = value["headers"]
    allowed = {"accept", "user-agent", "authorization", "content-type", "idempotency-key"}
    if type(headers) is not dict or not set(headers) <= allowed:
        raise ValueError()
    for key, item in headers.items():
        if type(item) is not str or len(item) > 1024 or any(ord(c) < 32 or ord(c) >= 127 for c in item):
            raise ValueError()
    timeout = value["socketTimeoutMilliseconds"]
    if type(timeout) is not int or not 1 <= timeout <= 120000:
        raise ValueError()
    body = value["body"]
    if value["method"] == "GET":
        if body is not None or "idempotency-key" in headers:
            raise ValueError()
    else:
        if (type(body) is not str or len(body.encode("utf-8")) > 24576 or not headers.get("idempotency-key")
                or headers.get("content-type") != "application/json" or type(_json(body.encode("utf-8"))) is not dict):
            raise ValueError()
    return value


class NoRedirect(HTTPRedirectHandler):
    def redirect_request(self, *args, **kwargs):
        return None


def send_once(value):
    # Explicit proxy handler prevents environment AND Windows registry discovery.
    context = ssl.create_default_context()
    context.check_hostname = True
    context.verify_mode = ssl.CERT_REQUIRED
    opener = build_opener(ProxyHandler({}), NoRedirect(), HTTPSHandler(context=context))
    body = value["body"].encode("utf-8") if value["body"] is not None else None
    request = Request(value["url"], data=body, headers=value["headers"], method=value["method"])
    try:
        response = opener.open(request, timeout=value["socketTimeoutMilliseconds"] / 1000)
    except HTTPError as exc:
        response = exc
    try:
        if response.geturl() != value["url"]:
            raise ValueError()
        headers = {}
        for name in ("Content-Type", "Content-Length", "Retry-After"):
            values = response.headers.get_all(name, [])
            if len(values) > 1 or (values and (len(values[0]) > 1024 or "\r" in values[0] or "\n" in values[0])):
                raise ValueError()
            if values:
                headers[name] = values[0]
        if "Content-Length" in headers:
            n = int(headers["Content-Length"])
            if not 0 <= n <= BODY_MAX:
                raise ValueError()
        raw = response.read(BODY_MAX + 1)
        if len(raw) > BODY_MAX:
            raise ValueError()
        if "Content-Length" in headers and len(raw) != int(headers["Content-Length"]):
            raise ValueError()
        status = response.getcode()
        if type(status) is not int or not 200 <= status <= 599:
            raise ValueError()
        return {"schemaVersion": SCHEMA, "kind": "response", "status": status,
                "headers": headers, "bodyBytes": len(raw)}, raw
    finally:
        response.close()


def emit(meta, raw=b""):
    encoded = json.dumps(meta, sort_keys=True, separators=(",", ":"), allow_nan=False).encode()
    if len(encoded) > META_MAX or len(raw) > BODY_MAX:
        raise ValueError()
    sys.stdout.buffer.write(struct.pack("!I", len(encoded)) + encoded + raw)
    sys.stdout.buffer.flush()


def main():
    try:
        value = read_request(sys.stdin.buffer)  # No socket before this GO frame.
        meta, raw = send_once(value)
        emit(meta, raw)
        return 0
    except BaseException:
        # Never print exception text, request, headers, body, or an HTTPError.
        try:
            emit({"schemaVersion": SCHEMA, "kind": "error", "code": "worker_request_failed"})
        except BaseException:
            pass
        return 2


if __name__ == "__main__":
    raise SystemExit(main())