"""Write-only import of the fixed controller enrollment bootstrap credential."""

from __future__ import annotations

import json
import sys

from sqlmodel import Session

from ..db.session import engine
from .repopulse_secret_import import (
    BOOTSTRAP_SECRET_REF,
    MAX_SECRET_BYTES,
    import_controller_bootstrap,
)


def main() -> int:
    raw = sys.stdin.buffer.read(MAX_SECRET_BYTES + 1)
    if len(raw) > MAX_SECRET_BYTES:
        print(json.dumps({"status": "blocked", "reason": "credential input too large"}))
        return 2
    try:
        token = raw.decode("utf-8")
        with Session(engine) as session:
            outcome = import_controller_bootstrap(session, token)
    except (UnicodeDecodeError, ValueError):
        print(json.dumps({"status": "blocked", "reason": "credential import rejected"}))
        return 2
    print(json.dumps({"status": outcome, "secretRef": BOOTSTRAP_SECRET_REF}))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())