#!/usr/bin/env python3
"""Validate tamper-evident Aegis audit log integrity."""

from __future__ import annotations

import argparse
import os
from pathlib import Path

from aegis_gitea_mcp.audit import validate_audit_log_integrity
from aegis_gitea_mcp.config import default_data_dir


def default_audit_path() -> Path:
    """Resolve the audit log path the server would use (env first, then DATA_DIR)."""
    explicit = os.environ.get("AUDIT_LOG_PATH", "").strip()
    if explicit:
        return Path(explicit).expanduser()
    data_dir = os.environ.get("DATA_DIR", "").strip()
    base = Path(data_dir).expanduser() if data_dir else default_data_dir()
    return base / "audit.log"


def parse_args() -> argparse.Namespace:
    """Parse command line arguments."""
    parser = argparse.ArgumentParser(description="Validate Aegis audit log hash chain")
    parser.add_argument(
        "--path",
        type=Path,
        default=default_audit_path(),
        help="Path to audit log file",
    )
    return parser.parse_args()


def main() -> int:
    """Validate audit chain and return process exit code."""
    args = parse_args()
    is_valid, errors = validate_audit_log_integrity(args.path)

    if is_valid:
        print(f"Audit log integrity OK: {args.path}")
        return 0

    print(f"Audit log integrity FAILED: {args.path}")
    for error in errors:
        print(f"- {error}")
    return 1


if __name__ == "__main__":
    raise SystemExit(main())