import json, os, sys, urllib.request, urllib.error


def run():
    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
    base = str(s.get("base_url") or "").strip().rstrip("/")
    if not base.startswith("https://"):
        print(json.dumps({"ok": False, "error": "base_url must be the relay's https:// address."}))
        sys.exit(1)
    # /healthz first: it answers anyone, so a failure there is the network or
    # the address, not the credential.
    try:
        urllib.request.urlopen(base + "/healthz", timeout=15).read()
    except Exception as e:
        print(json.dumps({"ok": False, "error": "The relay does not answer at %s/healthz: %s" % (base, e)}))
        sys.exit(1)
    req = urllib.request.Request(base + "/relay/v1/status", method="GET", headers={
        "Authorization": "Bearer " + str(s.get("read_token") or "").strip(), "Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=15) as r:
            status = json.loads(r.read() or b"{}")
    except urllib.error.HTTPError as e:
        if e.code == 404:
            err = ("The relay answers, but not to this Riposte: its proxy hides the reading API from addresses it "
                   "does not list. Add this Riposte's egress address to the Caddyfile and to "
                   "RELAY_CONSUMER_ALLOW_IPS — and check it does not leave through a proxy that changes it.")
        elif e.code == 401:
            err = ("The relay refused the read token, or this Riposte's address is not in "
                   "RELAY_CONSUMER_ALLOW_IPS. The relay's log line 'consumer refused' says which.")
        else:
            err = "HTTP %d from the relay." % e.code
        print(json.dumps({"ok": False, "error": err}))
        sys.exit(1)
    sources = sorted((status.get("sources") or {}).keys())
    print(json.dumps({"ok": True, "sources": sources}))


try:
    run()
except Exception as e:
    print(json.dumps({"ok": False, "error": str(e)}))
    sys.exit(1)