"""Authenticated, registration-scoped, GET-only Docker read broker."""

from __future__ import annotations

import base64
import hashlib
import hmac
import json
import re
import socket
import time
from collections.abc import Mapping, Sequence
from dataclasses import dataclass
from http.server import BaseHTTPRequestHandler
from typing import Any, Protocol, cast
from urllib.parse import parse_qs, quote, urlparse

_MAX_ENGINE_RESPONSE_BYTES = 4 * 1024 * 1024


class BrokerError(RuntimeError):
    def __init__(self, code: str, message: str, status: int = 400) -> None:
        self.code = code
        self.status = status
        super().__init__(message)


@dataclass(frozen=True)
class Registration:
    project: str
    environment: str
    registered_id: str
    container_id: str
    compose_project: str
    service: str
    allowed_reads: frozenset[str]

    def __post_init__(self) -> None:
        if not re.fullmatch(r"[a-z0-9][a-z0-9-]{0,62}", self.project) or not re.fullmatch(
            r"[a-z0-9][a-z0-9-]{0,31}", self.environment
        ):
            raise ValueError("registration scope is invalid")
        if not re.fullmatch(r"[a-z0-9][a-z0-9-]{0,127}", self.registered_id):
            raise ValueError("registered container id is invalid")
        if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,255}", self.container_id):
            raise ValueError("Docker container id is invalid")
        if not self.allowed_reads <= {"inspect", "health", "logs"}:
            raise ValueError("registration contains an unsupported read capability")


class RegistrationStore:
    """Registration is the authorization boundary; names and labels are never enough."""

    def __init__(self, registrations: Sequence[Registration] = ()) -> None:
        self._by_scope: dict[tuple[str, str, str], Registration] = {}
        for registration in registrations:
            key = (registration.project, registration.environment, registration.registered_id)
            if key in self._by_scope:
                raise ValueError("duplicate container registration")
            self._by_scope[key] = registration

    def list(self, project: str, environment: str) -> list[Registration]:
        return sorted(
            (
                item
                for (item_project, item_environment, _), item in self._by_scope.items()
                if item_project == project and item_environment == environment
            ),
            key=lambda item: item.registered_id,
        )

    def resolve(
        self, project: str, environment: str, registered_id: str, operation: str
    ) -> Registration:
        item = self._by_scope.get((project, environment, registered_id))
        if item is None or operation not in item.allowed_reads:
            raise BrokerError(
                "BROKER_CONTAINER_NOT_REGISTERED",
                "container is not registered for this project",
                403,
            )
        return item


class DockerBackend(Protocol):
    def host(self) -> Mapping[str, Any]: ...
    def storage(self) -> Sequence[Mapping[str, Any]]: ...
    def containers(self, state: str | None = None) -> Sequence[Mapping[str, Any]]: ...
    def inspect(self, container_id: str) -> Mapping[str, Any]: ...
    def health(self, container_id: str) -> Mapping[str, Any]: ...
    def logs(self, container_id: str, *, tail: int, since_seconds: int | None) -> Sequence[str]: ...
    def networks(self) -> Sequence[Mapping[str, Any]]: ...


class FakeDockerBackend:
    """Deterministic backend used by unit and contract tests."""

    def __init__(self) -> None:
        self.calls: list[str] = []
        self._containers: dict[str, dict[str, Any]] = {
            "container-web-001": {
                "Id": "container-web-001",
                "Name": "/ludarium-web",
                "Config": {
                    "Image": "ghcr.io/example/web:1.2.3",
                    "Env": ["TOKEN=secret-value"],
                    "Labels": {
                        "com.docker.compose.project": "ludarium",
                        "com.docker.compose.service": "web",
                        "com.example.owner": "itworx",
                    },
                },
                "State": {
                    "Status": "running",
                    "Running": True,
                    "StartedAt": "2026-08-01T10:00:00Z",
                    "Health": {"Status": "healthy"},
                    "RestartCount": 2,
                },
                "NetworkSettings": {
                    "Ports": {"8080/tcp": [{"HostPort": "18080", "HostIp": "127.0.0.1"}]},
                    "Networks": {"hub-connectors": {"Aliases": ["web"]}},
                },
            }
        }
        self._logs = {
            "container-web-001": [
                "INFO started",
                "Authorization: Bearer super-secret-token",
                "\x1b[31mready\x1b[0m",
            ]
        }

    def host(self) -> Mapping[str, Any]:
        self.calls.append("host")
        return {
            "hostname": "unraid-test",
            "uptimeSeconds": 3600,
            "cpuPercent": 12.5,
            "memoryUsedBytes": 100,
            "memoryTotalBytes": 1000,
            "dockerVersion": "27.0.0",
        }

    def storage(self) -> Sequence[Mapping[str, Any]]:
        self.calls.append("storage")
        return [{"name": "appdata", "driver": "local", "usageBytes": 1024, "capacityBytes": 4096}]

    def containers(self, state: str | None = None) -> Sequence[Mapping[str, Any]]:
        self.calls.append("containers")
        values = list(self._containers.values())
        return [
            item for item in values if state is None or item.get("State", {}).get("Status") == state
        ]

    def inspect(self, container_id: str) -> Mapping[str, Any]:
        self.calls.append("inspect")
        if container_id not in self._containers:
            raise BrokerError(
                "BROKER_TARGET_NOT_FOUND", "registered container no longer exists", 404
            )
        return self._containers[container_id]

    def health(self, container_id: str) -> Mapping[str, Any]:
        self.calls.append("health")
        item = self.inspect(container_id)
        state = item.get("State", {})
        health = state.get("Health", {}) if isinstance(state, Mapping) else {}
        return {
            "status": health.get("Status", "unknown"),
            "running": bool(state.get("Running", False)),
            "restartCount": int(state.get("RestartCount", 0)),
        }

    def logs(self, container_id: str, *, tail: int, since_seconds: int | None) -> Sequence[str]:
        self.calls.append("logs")
        if container_id not in self._logs:
            raise BrokerError(
                "BROKER_TARGET_NOT_FOUND", "registered container logs unavailable", 404
            )
        return self._logs[container_id][-tail:]

    def networks(self) -> Sequence[Mapping[str, Any]]:
        self.calls.append("networks")
        return [{"Name": "hub-connectors", "Id": "network-1", "Driver": "bridge", "Scope": "local"}]


class DockerEngineBackend:
    """Structured, allowlisted Docker Engine calls over the broker-only Unix socket."""

    def __init__(self, socket_path: str = "/var/run/docker.sock") -> None:
        self.socket_path = socket_path

    def _request(self, path: str) -> bytes:
        if not path.startswith(
            ("/version", "/info", "/containers/json", "/containers/", "/networks")
        ):
            raise BrokerError("BROKER_ROUTE_DENIED", "Docker route is not allowlisted", 403)
        request = f"GET {path} HTTP/1.1\r\nHost: docker\r\nConnection: close\r\n\r\n".encode()
        sock = socket.socket(getattr(socket, "AF_UNIX", socket.AF_INET), socket.SOCK_STREAM)
        try:
            sock.settimeout(10)
            sock.connect(self.socket_path)
            sock.sendall(request)
            chunks: list[bytes] = []
            total = 0
            while True:
                chunk = sock.recv(65536)
                if not chunk:
                    break
                total += len(chunk)
                if total > _MAX_ENGINE_RESPONSE_BYTES:
                    raise BrokerError(
                        "BROKER_RESPONSE_TOO_LARGE", "Docker response exceeds broker budget", 502
                    )
                chunks.append(chunk)
        except OSError as exc:
            raise BrokerError(
                "BROKER_SOCKET_UNAVAILABLE", "Docker socket is unavailable", 503
            ) from exc
        finally:
            sock.close()
        return _decode_http_response(b"".join(chunks))

    def _get(self, path: str) -> Any:
        try:
            return json.loads(self._request(path).decode("utf-8"))
        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid JSON", 502
            ) from exc

    def host(self) -> Mapping[str, Any]:
        version = cast(Mapping[str, Any], self._get("/version"))
        info = cast(Mapping[str, Any], self._get("/info"))
        return {
            "hostname": info.get("Name", ""),
            "uptimeSeconds": 0,
            "cpuPercent": None,
            "memoryUsedBytes": 0,
            "memoryTotalBytes": int(info.get("MemTotal", 0)),
            "dockerVersion": version.get("Version"),
        }

    def storage(self) -> Sequence[Mapping[str, Any]]:
        value = cast(Mapping[str, Any], self._get("/info"))
        return _storage_rows(value)

    def containers(self, state: str | None = None) -> Sequence[Mapping[str, Any]]:
        query = "?all=1"
        if state:
            query += "&filters=" + _json_query({"status": [state]})
        value = self._get("/containers/json" + query)
        return cast(Sequence[Mapping[str, Any]], value if isinstance(value, list) else [])

    def inspect(self, container_id: str) -> Mapping[str, Any]:
        return cast(Mapping[str, Any], self._get(f"/containers/{container_id}/json"))

    def health(self, container_id: str) -> Mapping[str, Any]:
        item = self.inspect(container_id)
        state_value = item.get("State")
        state = state_value if isinstance(state_value, Mapping) else {}
        health_value = state.get("Health")
        health = health_value if isinstance(health_value, Mapping) else {}
        return {
            "status": str(health.get("Status", "unknown")),
            "running": bool(state.get("Running", False)),
            "restartCount": int(state.get("RestartCount", 0)),
        }

    def logs(self, container_id: str, *, tail: int, since_seconds: int | None) -> Sequence[str]:
        query = f"?stdout=1&stderr=1&tail={tail}" + (
            f"&since={max(int(time.time()) - since_seconds, 0)}" if since_seconds else ""
        )
        value = self._request(f"/containers/{container_id}/logs{query}")
        return _decode_docker_log_stream(value)[-tail:]

    def networks(self) -> Sequence[Mapping[str, Any]]:
        value = self._get("/networks")
        return cast(Sequence[Mapping[str, Any]], value if isinstance(value, list) else [])


def _json_query(value: object) -> str:
    return quote(json.dumps(value, separators=(",", ":")), safe="")


def _decode_http_response(raw: bytes) -> bytes:
    header_block, separator, body = raw.partition(b"\r\n\r\n")
    if not separator:
        raise BrokerError("BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid HTTP", 502)
    lines = header_block.split(b"\r\n")
    status = lines[0].split(b" ", 2) if lines else []
    if len(status) < 2 or not status[0].startswith(b"HTTP/") or not status[1].isdigit():
        raise BrokerError("BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid HTTP", 502)
    status_code = int(status[1])
    headers: dict[bytes, bytes] = {}
    for line in lines[1:]:
        name, marker, value = line.partition(b":")
        if not marker or not name.strip():
            raise BrokerError("BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid HTTP", 502)
        headers[name.strip().lower()] = value.strip().lower()
    transfer_encoding = headers.get(b"transfer-encoding")
    if transfer_encoding:
        if transfer_encoding != b"chunked":
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned unsupported encoding", 502
            )
        body = _decode_chunked_body(body)
    elif b"content-length" in headers:
        try:
            expected = int(headers[b"content-length"])
        except ValueError as exc:
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid length", 502
            ) from exc
        if expected < 0 or expected > _MAX_ENGINE_RESPONSE_BYTES or len(body) != expected:
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid length", 502
            )
    if not 200 <= status_code < 300:
        raise BrokerError("BROKER_ENGINE_ERROR", "Docker read request failed", 502)
    return body


def _decode_chunked_body(value: bytes) -> bytes:
    position = 0
    decoded = bytearray()
    while True:
        line_end = value.find(b"\r\n", position)
        if line_end < 0:
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid chunks", 502
            )
        size_text = value[position:line_end].split(b";", 1)[0].strip()
        if not re.fullmatch(rb"[0-9A-Fa-f]{1,16}", size_text):
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid chunks", 502
            )
        size = int(size_text, 16)
        position = line_end + 2
        if size == 0:
            trailer = value[position:]
            if trailer != b"\r\n" and not trailer.endswith(b"\r\n\r\n"):
                raise BrokerError(
                    "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid chunks", 502
                )
            return bytes(decoded)
        if size > _MAX_ENGINE_RESPONSE_BYTES - len(decoded):
            raise BrokerError(
                "BROKER_RESPONSE_TOO_LARGE", "Docker response exceeds broker budget", 502
            )
        chunk_end = position + size
        if chunk_end + 2 > len(value) or value[chunk_end : chunk_end + 2] != b"\r\n":
            raise BrokerError(
                "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid chunks", 502
            )
        decoded.extend(value[position:chunk_end])
        position = chunk_end + 2


def _decode_docker_log_stream(value: bytes) -> list[str]:
    decoded = bytearray()
    position = 0
    multiplexed = len(value) >= 8 and value[0] in (1, 2)
    if not multiplexed:
        decoded.extend(value)
    else:
        while position < len(value):
            if (
                position + 8 > len(value)
                or value[position] not in (1, 2)
                or value[position + 1 : position + 4] != b"\x00\x00\x00"
            ):
                raise BrokerError(
                    "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid log frames", 502
                )
            size = int.from_bytes(value[position + 4 : position + 8], "big")
            position += 8
            if size > _MAX_ENGINE_RESPONSE_BYTES - len(decoded) or position + size > len(value):
                raise BrokerError(
                    "BROKER_INVALID_ENGINE_RESPONSE", "Docker returned invalid log frames", 502
                )
            decoded.extend(value[position : position + size])
            position += size
    return decoded.decode("utf-8", errors="replace").splitlines()


def _storage_rows(value: Mapping[str, Any]) -> list[dict[str, Any]]:
    return [
        {
            "name": "docker-root",
            "driver": str(value.get("Driver", "unknown")),
            "usageBytes": 0,
            "capacityBytes": 0,
        },
    ]


_ANSI = re.compile(r"\x1b\[[0-?]*[ -/]*[@-~]")
_SECRET = re.compile(
    r"(?i)(authorization\s*[:=]\s*bearer\s+|bearer\s+|(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*)[^\s,;]+"
)
_PRIVATE_KEY = re.compile(
    r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----.*?-----END [A-Z0-9 ]*PRIVATE KEY-----", re.S
)
_CONTROL = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")


def redact_log_line(value: str) -> tuple[str, int]:
    line = _ANSI.sub("", value)
    line = _CONTROL.sub("", line)
    count = 0
    line, private_count = _PRIVATE_KEY.subn("<redacted>", line)
    count += private_count
    line, secret_count = _SECRET.subn(lambda match: match.group(1) + "<redacted>", line)
    count += secret_count
    return line.encode("utf-8")[:4096].decode("utf-8", errors="ignore"), count


def normalize_container(raw: Mapping[str, Any], registered_id: str) -> dict[str, Any]:
    config_value = raw.get("Config")
    config = config_value if isinstance(config_value, Mapping) else {}
    state_value = raw.get("State")
    state = state_value if isinstance(state_value, Mapping) else {}
    network_value = raw.get("NetworkSettings")
    network_settings = network_value if isinstance(network_value, Mapping) else {}
    labels_value = config.get("Labels")
    labels = labels_value if isinstance(labels_value, Mapping) else {}
    networks_value = network_settings.get("Networks")
    networks = networks_value if isinstance(networks_value, Mapping) else {}
    ports_value = network_settings.get("Ports")
    ports = ports_value if isinstance(ports_value, Mapping) else {}
    safe_labels = {
        key: str(labels[key])[:200]
        for key in ("com.docker.compose.project", "com.docker.compose.service", "com.example.owner")
        if key in labels
    }
    health_value = state.get("Health")
    health = health_value if isinstance(health_value, Mapping) else {}
    safe_ports = {
        str(key)[:64]: [
            {
                "hostIp": str(item.get("HostIp", ""))[:64],
                "hostPort": str(item.get("HostPort", ""))[:16],
            }
            for item in value
            if isinstance(item, Mapping)
        ][:8]
        for key, value in ports.items()
        if isinstance(value, list)
    }
    return {
        "containerRef": registered_id,
        "name": str(raw.get("Name", "")).lstrip("/")[:255],
        "image": str(config.get("Image", ""))[:512],
        "state": str(state.get("Status", "unknown"))[:32],
        "health": str(health.get("Status", "none"))[:32],
        "startedAt": str(state.get("StartedAt", ""))[:64],
        "restartCount": int(state.get("RestartCount", 0)),
        "ports": safe_ports,
        "networks": sorted(str(name)[:128] for name in networks),
        "labels": safe_labels,
    }


class ServiceTokenVerifier:
    """Verify short-lived HMAC service tokens without exposing their values."""

    def __init__(self, secret: str, audience: str = "docker-read-broker") -> None:
        self._secret = secret.encode()
        self.audience = audience

    def verify(self, token: str) -> tuple[str, str]:
        try:
            encoded_payload, encoded_signature = token.split(".", 1)
            expected = hmac.new(self._secret, encoded_payload.encode(), hashlib.sha256).digest()
            if not hmac.compare_digest(_b64decode(encoded_signature), expected):
                raise ValueError
            payload = json.loads(_b64decode(encoded_payload).decode())
            if payload.get("aud") != self.audience or int(payload.get("exp", 0)) < int(time.time()):
                raise ValueError
            project, environment = str(payload["project"]), str(payload["environment"])
            if not re.fullmatch(r"[a-z0-9][a-z0-9-]{0,62}", project) or not re.fullmatch(
                r"[a-z0-9][a-z0-9-]{0,31}", environment
            ):
                raise ValueError
            return project, environment
        except (ValueError, KeyError, TypeError, json.JSONDecodeError) as exc:
            raise BrokerError(
                "BROKER_AUTH_INVALID", "internal service authentication failed", 401
            ) from exc


def _b64decode(value: str) -> bytes:
    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))


class BrokerApp:
    def __init__(
        self,
        backend: DockerBackend,
        registrations: RegistrationStore,
        verifier: ServiceTokenVerifier,
    ) -> None:
        self.backend = backend
        self.registrations = registrations
        self.verifier = verifier

    def handle(
        self, method: str, path: str, headers: Mapping[str, str] | None = None
    ) -> tuple[int, dict[str, Any]]:
        if path == "/healthz" and method == "GET":
            return 200, {"status": "ok", "capability": "docker-read-broker"}
        if method != "GET":
            return 405, {"code": "BROKER_METHOD_NOT_ALLOWED", "message": "only GET is supported"}
        headers = headers or {}
        auth = headers.get("authorization", headers.get("Authorization", ""))
        if not auth.startswith("Bearer "):
            return 401, {
                "code": "BROKER_AUTH_REQUIRED",
                "message": "internal service authentication required",
            }
        try:
            project, environment = self.verifier.verify(auth.removeprefix("Bearer "))
            parsed = urlparse(path)
            route = parsed.path.rstrip("/")
            query = parse_qs(parsed.query)
            return 200, self._route(project, environment, route, query)
        except BrokerError as exc:
            return exc.status, {"code": exc.code, "message": str(exc)}

    @staticmethod
    def _assert_registered(raw: Mapping[str, Any], registration: Registration) -> None:
        if str(raw.get("Id", "")) != registration.container_id:
            raise BrokerError(
                "BROKER_REGISTRATION_MISMATCH", "Docker identity does not match registration", 403
            )
        config_value = raw.get("Config")
        config = config_value if isinstance(config_value, Mapping) else {}
        labels_value = config.get("Labels")
        labels = labels_value if isinstance(labels_value, Mapping) else {}
        if (
            labels.get("com.docker.compose.project") != registration.compose_project
            or labels.get("com.docker.compose.service") != registration.service
        ):
            raise BrokerError(
                "BROKER_REGISTRATION_MISMATCH", "Docker labels do not match registration", 403
            )

    def _route(
        self, project: str, environment: str, route: str, query: Mapping[str, list[str]]
    ) -> dict[str, Any]:
        if route == "/v1/host":
            raw = self.backend.host()
            return {
                "hostname": str(raw.get("hostname", ""))[:255],
                "uptimeSeconds": max(int(raw.get("uptimeSeconds", 0)), 0),
                "cpuPercent": raw.get("cpuPercent"),
                "memoryUsedBytes": max(int(raw.get("memoryUsedBytes", 0)), 0),
                "memoryTotalBytes": max(int(raw.get("memoryTotalBytes", 0)), 0),
                "dockerVersion": str(raw.get("dockerVersion"))[:100]
                if raw.get("dockerVersion") is not None
                else None,
            }
        if route == "/v1/storage":
            return {
                "items": [
                    {
                        "name": str(item.get("name", ""))[:128],
                        "driver": str(item.get("driver", ""))[:64],
                        "usageBytes": max(int(item.get("usageBytes", 0)), 0),
                        "capacityBytes": max(int(item.get("capacityBytes", 0)), 0),
                    }
                    for item in self.backend.storage()
                ]
            }
        if route == "/v1/networks":
            return {"items": [self._network(item) for item in self.backend.networks()]}
        if route == "/v1/containers":
            state_values = query.get("state")
            state = state_values[0] if state_values else None
            registered = {
                item.container_id: item for item in self.registrations.list(project, environment)
            }
            items = []
            for item in self.backend.containers(state):
                if not isinstance(item, Mapping) or str(item.get("Id", "")) not in registered:
                    continue
                registration = registered[str(item["Id"])]
                inspected = self.backend.inspect(registration.container_id)
                self._assert_registered(inspected, registration)
                items.append(normalize_container(inspected, registration.registered_id))
            return {"items": items}
        match = re.fullmatch(r"/v1/containers/([a-z0-9][a-z0-9-]{0,127})(?:/(health|logs))?", route)
        if not match:
            raise BrokerError("BROKER_ROUTE_DENIED", "broker route is not allowlisted", 404)
        registered_id, suffix = match.groups()
        operation = "inspect" if suffix is None else suffix
        registration = self.registrations.resolve(project, environment, registered_id, operation)
        inspected = self.backend.inspect(registration.container_id)
        self._assert_registered(inspected, registration)
        if suffix is None:
            return normalize_container(inspected, registered_id)
        if suffix == "health":
            raw_health = self.backend.health(registration.container_id)
            return {
                "status": str(raw_health.get("status", "unknown"))[:32],
                "running": bool(raw_health.get("running", False)),
                "restartCount": max(int(raw_health.get("restartCount", 0)), 0),
            }
        try:
            tail = min(max(int((query.get("tail") or ["200"])[0]), 1), 500)
            since_values = query.get("sinceSeconds")
            since = since_values[0] if since_values else None
            since_seconds = int(since) if since is not None else None
        except (TypeError, ValueError) as exc:
            raise BrokerError("BROKER_QUERY_INVALID", "log query is invalid") from exc
        if since_seconds is not None and not 1 <= since_seconds <= 86400:
            raise BrokerError("BROKER_QUERY_INVALID", "sinceSeconds is outside the allowed range")
        contains_values = query.get("contains")
        contains = contains_values[0] if contains_values else None
        lines = []
        redactions = 0
        for raw_line in self.backend.logs(
            registration.container_id, tail=tail, since_seconds=since_seconds
        ):
            line, count = redact_log_line(str(raw_line))
            if contains and contains not in line:
                continue
            lines.append(line)
            redactions += count
        return {
            "containerRef": registered_id,
            "lines": lines[-tail:],
            "truncated": len(lines) > tail,
            "redactionsApplied": redactions,
        }

    @staticmethod
    def _network(raw: Mapping[str, Any]) -> dict[str, Any]:
        return {
            "name": str(raw.get("Name", ""))[:128],
            "networkRef": str(raw.get("Id", ""))[:128],
            "driver": str(raw.get("Driver", ""))[:64],
            "scope": str(raw.get("Scope", ""))[:32],
        }


def make_handler(app: BrokerApp) -> type[BaseHTTPRequestHandler]:
    class Handler(BaseHTTPRequestHandler):
        server_version = "ITWorxDockerReadBroker/1.0"

        def do_GET(self) -> None:  # noqa: N802
            self._dispatch("GET")

        def do_POST(self) -> None:  # noqa: N802
            self._dispatch("POST")

        def do_PUT(self) -> None:  # noqa: N802
            self._dispatch("PUT")

        def do_DELETE(self) -> None:  # noqa: N802
            self._dispatch("DELETE")

        def _dispatch(self, method: str) -> None:
            status, body = app.handle(method, self.path, dict(self.headers.items()))
            encoded = json.dumps(body, separators=(",", ":")).encode()
            self.send_response(status)
            self.send_header("Content-Type", "application/json")
            self.send_header("Content-Length", str(len(encoded)))
            self.end_headers()
            self.wfile.write(encoded)

        def log_message(self, _format: str, *_args: object) -> None:
            return

    return Handler