import os
import re
import subprocess
from flask import Flask, request, jsonify

APP = Flask(__name__)

STORE_DIR = os.environ.get("CCP_OTS_DIR", "/var/lib/ccp-ots")
TOKEN = os.environ.get("CCP_OTS_TOKEN", "")
HASH_RE = re.compile(r"^[a-f0-9]{64}$")

def require_token(req):
    if not TOKEN:
        return True  # token non impostato: allow (lo impostiamo dopo)
    return req.headers.get("X-CCP-Token", "") == TOKEN

@APP.post("/stamp")
def stamp():
    if not require_token(request):
        return jsonify({"error": "unauthorized"}), 401

    data = request.get_json(silent=True) or {}
    h = (data.get("sha256") or "").strip().lower()
    if not HASH_RE.match(h):
        return jsonify({"error": "invalid_sha256"}), 400

    os.makedirs(STORE_DIR, exist_ok=True)

    txt_path = os.path.join(STORE_DIR, f"{h}.txt")
    ots_path = txt_path + ".ots"

    # Commit file (solo hash)
    with open(txt_path, "w", encoding="utf-8") as f:
        f.write(h + "\n")

    # Genera .ots se non esiste
    if not os.path.exists(ots_path):
        p = subprocess.run(["ots", "stamp", txt_path], capture_output=True, text=True)
        if p.returncode != 0:
            return jsonify({"error": "ots_stamp_failed", "details": (p.stderr or "")[-500:]}), 500

    return jsonify({
        "ok": True,
        "sha256": h,
        "commit_file": txt_path,
        "ots_file": ots_path
    })

@APP.get("/status/<sha256>")
def status(sha256):
    if not require_token(request):
        return jsonify({"error": "unauthorized"}), 401

    h = (sha256 or "").strip().lower()
    if not HASH_RE.match(h):
        return jsonify({"error": "invalid_sha256"}), 400

    txt_path = os.path.join(STORE_DIR, f"{h}.txt")
    ots_path = txt_path + ".ots"
    if not os.path.exists(ots_path):
        return jsonify({"ok": False, "status": "missing"}), 404

    p = subprocess.run(["ots", "verify", ots_path], capture_output=True, text=True)
    out = ((p.stdout or "") + "\n" + (p.stderr or "")).strip()

    # Pending finché non è ancorato
    status_val = "anchored" if ("Success" in out or "Verified" in out) else "pending"

    return jsonify({
        "ok": True,
        "sha256": h,
        "status": status_val,
        "raw": out[-1500:]
    })