#!/usr/bin/env python3

"""
Nginx Proxy Manager ACME authority patch orchestrator.

This module:
  1. Reads ACME gate configuration from environment variables.
  2. Loads NPM certificate.js.
  3. Applies only the requested mutations.
  4. Verifies every requested mutation.
  5. Writes the resulting source only after all enabled gates succeed.

Runtime ACME authority is NOT controlled here.
Patched NPM code reads the Pacemaker-controlled authority token.
"""

from __future__ import annotations

import os
from pathlib import Path

from functions import common
from functions import request
from functions import renew
from functions import revoke


DEFAULT_CERTIFICATE_JS = "/app/internal/certificate.js"


def main() -> None:
    certificate_js = Path(
        os.environ.get(
            "NPM_CERTIFICATE_JS",
            DEFAULT_CERTIFICATE_JS,
        )
    )

    config = common.load_config()

    common.log(f"certificate.js={certificate_js}")
    common.log(f"request_gate={config.request}")
    common.log(f"renew_gate={config.renew}")
    common.log(f"revoke_gate={config.revoke}")

    source = common.load_source(certificate_js)

    if config.any_enabled:
        source = common.apply_authority_helper(source)

    if config.request:
        source = request.apply(source)

    if config.renew:
        source = renew.apply(source)

    if config.revoke:
        source = revoke.apply(source)

    common.verify(source, config)
    common.write_source(certificate_js, source)

    common.log("All requested ACME authority gates applied successfully")


if __name__ == "__main__":
    main()