"""Prepare isolated HTTPS QA only; no active application/configuration writes."""
from pathlib import Path
from datetime import datetime,timedelta,timezone
import json,secrets
from cryptography import x509
from cryptography.x509.oid import NameOID,ExtendedKeyUsageOID
from cryptography.hazmat.primitives import hashes,serialization
from cryptography.hazmat.primitives.asymmetric import rsa

ROOT=Path(__file__).resolve().parent.parent
PRIVATE=ROOT/'storage/app/private/investmoz-v2/portal-audit'
read=lambda p:json.loads(Path(p).read_text(encoding='utf-8-sig'))
source=Path(read(PRIVATE/'country-c110-source-latest.json')['source'])
work=PRIVATE/'country-https-20261011';work.mkdir(exist_ok=False)
now=datetime.now(timezone.utc)
ca_key=rsa.generate_private_key(public_exponent=65537,key_size=2048)
ca_name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'InvestMoz COUNTRY02 QA 20261011')])
ca=(x509.CertificateBuilder().subject_name(ca_name).issuer_name(ca_name).public_key(ca_key.public_key())
    .serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=5)).not_valid_after(now+timedelta(days=2))
    .add_extension(x509.BasicConstraints(ca=True,path_length=0),True)
    .add_extension(x509.KeyUsage(False,False,False,False,False,True,True,False,False),True)
    .add_extension(x509.NameConstraints([x509.DNSName('country02-qa.test')],None),True)
    .sign(ca_key,hashes.SHA256()))
leaf_key=rsa.generate_private_key(public_exponent=65537,key_size=2048)
leaf=(x509.CertificateBuilder().subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'country02-qa.test')]))
    .issuer_name(ca_name).public_key(leaf_key.public_key()).serial_number(x509.random_serial_number())
    .not_valid_before(now-timedelta(minutes=5)).not_valid_after(now+timedelta(days=1))
    .add_extension(x509.BasicConstraints(ca=False,path_length=None),True)
    .add_extension(x509.SubjectAlternativeName([x509.DNSName('country02-qa.test')]),False)
    .add_extension(x509.ExtendedKeyUsage([ExtendedKeyUsageOID.SERVER_AUTH]),False)
    .add_extension(x509.KeyUsage(True,False,True,False,False,False,False,False,False),True)
    .sign(ca_key,hashes.SHA256()))
(work/'qa-ca.cer').write_bytes(ca.public_bytes(serialization.Encoding.DER))
(work/'qa-ca.pem').write_bytes(ca.public_bytes(serialization.Encoding.PEM))
(work/'qa-server.pem').write_bytes(leaf.public_bytes(serialization.Encoding.PEM)+ca.public_bytes(serialization.Encoding.PEM))
(work/'qa-server-key.pem').write_bytes(leaf_key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))
# CA signing key deliberately not persisted; no further certificates can be minted.
meta={'work':str(work),'source':str(source),'base':'https://country02-qa.test:18443','http_redirect':'http://country02-qa.test:18105',
    'backend':'127.0.0.1:18104','qa_proxy_token':secrets.token_hex(32),'ca_thumbprint':ca.fingerprint(hashes.SHA1()).hex().upper(),
    'ca_sha256':ca.fingerprint(hashes.SHA256()).hex(),'leaf_sha256':leaf.fingerprint(hashes.SHA256()).hex(),
    'san':['country02-qa.test'],'valid_until':leaf.not_valid_after_utc.isoformat(),'ca_valid_until':ca.not_valid_after_utc.isoformat(),
    'trust_store':'CurrentUser/Root only','active_config_changed':False}
(PRIVATE/'country-https-latest.json').write_text(json.dumps(meta,indent=2),encoding='utf-8')
backup=(source/'tools/portal-country-c110-backup.php').read_text(encoding='utf-8').replace('country-c110-backup-latest.json','country-https-backup-latest.json')
(source/'tools/portal-country-https-backup.php').write_text(backup,encoding='utf-8')
router=(source/'tools/portal-country-c110-qa.php').read_text(encoding='utf-8')
router=router.replace('country-candidate-backup-latest.json','country-https-backup-latest.json').replace('country-production-browser-target.json','country-https-browser-target.json')
router=router.replace('http://country02-qa.test:18103',meta['base']).replace('country_c110_18103_qa','country_https_18443_qa')
anchor="$path = rawurldecode(parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/');"
pre="""$tls = json_decode(file_get_contents('C:/laragon/www/portal-investidor/storage/app/private/investmoz-v2/portal-audit/country-https-latest.json'), true, 512, JSON_THROW_ON_ERROR);
if (PHP_SAPI !== 'cli') {
    if (! hash_equals($tls['qa_proxy_token'], $_SERVER['HTTP_X_QA_TLS_TOKEN'] ?? '') || ($_SERVER['HTTP_HOST'] ?? '') !== 'country02-qa.test:18443') { http_response_code(403); exit; }
    $_SERVER['HTTPS'] = 'on'; $_SERVER['SERVER_PORT'] = '18443'; $_SERVER['REQUEST_SCHEME'] = 'https';
}
"""
assert anchor in router;router=router.replace(anchor,pre+anchor)
anchor="'APP_DEBUG' => 'false'"
router=router.replace(anchor,"'SESSION_SECURE_COOKIE' => 'true', 'SESSION_DOMAIN' => '', 'SESSION_SAME_SITE' => 'lax', "+anchor)
router=router.replace("config(['session.driver' => $proof['runtime']['session_driver'],", "config(['session.secure' => true, 'session.domain' => null, 'session.path' => '/', 'session.same_site' => 'lax', 'session.driver' => $proof['runtime']['session_driver'],")
router=router.replace("header('X-Investmoz-QA-Target: '.$identity->database", "header('X-Investmoz-QA-HTTPS: verified-loopback-termination');\nheader('X-Investmoz-QA-Target: '.$identity->database")
(source/'tools/portal-country-https-qa.php').write_text(router,encoding='utf-8')
print(json.dumps({k:v for k,v in meta.items() if k!='qa_proxy_token'}))