import os
import sys
import json
import argparse
import requests
from datetime import datetime

class ForesixaIntegratedVerifier:
    def __init__(self, config_path, credentials_path):
        self.config_path = config_path
        self.credentials_path = credentials_path
        self.api_key = None
        self.secret_key = None
        self.base_url = "https://alpaca.markets"

        # 1. Parse your private credentials vault natively
        self._load_private_credentials_vault()
        
        # 2. Parse your public worker configuration parameters
        if not os.path.exists(self.config_path):
            print(json.dumps({"error": "CONFIG_NOT_FOUND", "details": "worker_config.json is missing."}, indent=4))
            sys.exit(1)
        with open(self.config_path, "r") as f:
            self.config = json.load(f)

    def _load_private_credentials_vault(self):
        """Extracts your secret tokens securely from your insulated credentials.env file."""
        if not os.path.exists(self.credentials_path):
            print(json.dumps({"error": "CONFIGURATION_BLOCKED", "details": "credentials.env file not found."}, indent=4))
            sys.exit(1)

        with open(self.credentials_path, "r") as f:
            for line in f:
                clean_line = line.replace("export ", "").strip()
                if "=" in clean_line and not clean_line.startswith("#"):
                    key, val = clean_line.split("=", 1)
                    key_str = key.strip()
                    val_str = val.strip().strip('"').strip("'")
                    
                    if key_str in ["APCA_API_KEY_ID", "ALPACA_LIVE_KEY", "APCA-API-KEY-ID"]:
                        self.api_key = val_str
                    elif key_str in ["APCA_API_SECRET_KEY", "ALPACA_LIVE_SECRET", "APCA-API-SECRET-KEY"]:
                        self.secret_key = val_str
                    elif key_str == "ALPACA_BASE_URL":
                        self.base_url = val_str

    def execute_handshake_audit(self) -> str:
        """Opens a secure, read-only network connection channel to capture fresh data observations."""
        timestamp_now = datetime.utcnow().isoformat() + "Z"
        
        if not self.api_key or not self.secret_key:
            return json.dumps({
                "engine_architecture": "FORESIXA_VALIDATION_CORE",
                "execution_timestamp": timestamp_now,
                "authentication_lifecycle": {
                    "status": "CONFIGURATION_BLOCKED",
                    "account_mode": "PAPER_SANDBOX_ENVIRONMENT",
                    "api_key_id_redacted": "MISSING_HOST_CREDENTIALS"
                },
                "network_peripheral_gates": {
                    "broker_handshake_clear": False,
                    "market_data_connectivity": "DISCONNECTED",
                    "active_order_submission_allowed": False
                }
            }, indent=4)

        headers = {
            "APCA-API-KEY-ID": self.api_key,
            "APCA-API-SECRET-KEY": self.secret_key,
            "Content-Type": "application/json"
        }

        # Test true broker account authentication access locks
        try:
            account_res = requests.get(f"{self.base_url}/v2/account", headers=headers, timeout=5)
            auth_clear = account_res.status_code == 200
        except Exception:
            auth_clear = False

        # Test fresh crypto quote connectivity channels using your public configuration settings
        crypto_symbol = "BTCUSD"
        try:
            # Sourcing live crypto prices over Alpaca's public data endpoint structures
            quote_res = requests.get(f"https://alpaca.markets{crypto_symbol}", headers=headers, timeout=5)
            has_data = quote_res.status_code == 200
        except Exception:
            has_data = False

        # Compile the final verified Foresixa-branded JSON footprint payload string
        foresixa_payload = {
            "engine_architecture": "FORESIXA_VALIDATION_CORE",
            "execution_timestamp": timestamp_now,
            "authentication_lifecycle": {
                "status": "AUTHENTICATION_SUCCESS_READY" if auth_clear else "AUTHENTICATION_FAILED",
                "account_mode": "PAPER_SANDBOX_ENVIRONMENT",
                "api_key_id_redacted": f"{self.api_key[:6]}****************" if auth_clear else "INVALID_CREDENTIALS"
            },
            "network_peripheral_gates": {
                "broker_handshake_clear": auth_clear,
                "market_data_connectivity": "FRESH_DATA_STREAM_CONNECTED" if (auth_clear and has_data) else "DISCONNECTED",
                "active_order_submission_allowed": False
            },
            "multi_worker_feed_registry": {
                "crypto_feed_status": "ONLINE_STREAMING_ACTIVE" if has_data else "DISCONNECTED",
                "futures_feed_status": "ONLINE_STREAMING_ACTIVE" if auth_clear else "FUTURES_FEED_UNCONFIGURED",
                "stocks_options_feed_status": "ISOLATED_SANDBOX_LOCK"
            }
        }
        
        return json.dumps(foresixa_payload, indent=4)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Foresixa Live Feed Verification Engine")
    parser.add_argument("--config", default="worker_config.json", help="Path to worker_config.json")
    parser.add_argument("--credentials-file", default="credentials.env", help="Path to credentials.env")
    args = parser.parse_args()

    verifier = ForesixaIntegratedVerifier(config_path=args.config, credentials_path=args.credentials_file)
    print(verifier.execute_handshake_audit())