"""Read-only, process-scoped signing token audit; never prints or changes secrets."""
import argparse,hashlib,hmac,json,os,secrets,subprocess,sys
from infinbot_common import private_read,Rejected

def forbidden_value():
    return ('PRODUCTION_HARDENED_HMAC_SIGNING_KEY_'+'REPLACE_ME_VIA_ENV').encode()

def audit(token_file=None,*,keychain_service=None,environment=None):
    env=dict(os.environ if environment is None else environment)
    present=sum(forbidden_value() in str(v).encode() for v in env.values())
    result={'scope':'This acceptance process environment and explicitly selected private token file',
            'disclosed_placeholder_present':bool(present),'external_token_loaded':False,
            'secret_values_displayed':False,'environment_modified':False,
            'other_processes_and_system_vaults':'NOT_INSPECTED',
            'production_signing_consumer_verified':False,'status':'SIGNING_CONFIGURATION_UNVERIFIED'}
    if present:
        result['status']='DISCLOSED_PLACEHOLDER_DETECTED';return result
    path=token_file or env.get('INFINBOT_HMAC_TOKEN_FILE')
    service=keychain_service or env.get('INFINBOT_HMAC_KEYCHAIN_SERVICE')
    if not path and not service:return result
    try:
        if path and service:raise Rejected('Select exactly one external token source')
        if service:
            if sys.platform!='darwin' or not isinstance(service,str) or not service or len(service)>128 or any(c in service for c in '\x00\r\n'):raise Rejected('Explicit existing Mac Keychain service required')
            completed=subprocess.run(['/usr/bin/security','find-generic-password','-s',service,'-w'],capture_output=True,timeout=15)
            if completed.returncode:raise Rejected('Private Keychain token unavailable')
            token=completed.stdout.strip();result['external_source']='MACOS_KEYCHAIN'
        else:
            token=private_read(path,1024).strip();result['external_source']='OWNER_PRIVATE_FILE'
        if not 32<=len(token)<=1024 or forbidden_value() in token or b'REPLACE_ME' in token or len(set(token))<12:
            raise Rejected('Invalid private signing token')
        challenge=secrets.token_bytes(32)
        a=hmac.digest(token,challenge,hashlib.sha256)
        if not hmac.compare_digest(a,hmac.digest(token,challenge,hashlib.sha256)):raise Rejected('Local signing failure')
        result.update(status='PROCESS_PLACEHOLDER_ABSENT_EXTERNAL_TOKEN_LOADED',external_token_loaded=True,
                      local_hmac_roundtrip_passed=True)
    except Exception:result['status']='PRIVATE_SIGNING_TOKEN_UNAVAILABLE_OR_UNSAFE'
    return result

if __name__=='__main__':
    p=argparse.ArgumentParser(description=__doc__);p.add_argument('--token-file');p.add_argument('--keychain-service');a=p.parse_args()
    result=audit(a.token_file,keychain_service=a.keychain_service);print(json.dumps(result,indent=2))
    raise SystemExit(result['status']!='PROCESS_PLACEHOLDER_ABSENT_EXTERNAL_TOKEN_LOADED')