"""Synthetic enterprise portal (runs ON THE EXECUTOR NODE, loopback only). Generic: driven by the scenario's portal/portal.json.
Serves: login, document library (downloads from inputs/), record tables (HTML + JSON API), forms whose submissions are appended to
out/portal_submissions.json. It never holds information absent from inputs/ (information constancy across arms).
Usage: python -m wp42.portal --workspace <dir> --port <n> [--token <t>]"""
from __future__ import annotations
import argparse, json, os, secrets, time
from flask import Flask, request, redirect, send_from_directory, session, abort, jsonify, Response

HTML = """<!doctype html><html><head><meta charset="utf-8"><title>{org} — Enterprise Portal</title>
<style>body{{font-family:-apple-system,Helvetica,Arial;margin:2rem;color:#222}}table{{border-collapse:collapse}}td,th{{border:1px solid #ccc;padding:4px 8px;font-size:14px}}nav a{{margin-right:1rem}}</style></head>
<body><h1>{org}</h1><nav><a href="/">Home</a><a href="/documents">Documents</a>{nav}<a href="/forms">Forms</a><a href="/logout">Log out</a></nav><hr>{body}</body></html>"""

def make_app(workspace: str) -> Flask:
    cfg = json.load(open(os.path.join(workspace, "portal", "portal.json"), encoding="utf-8"))
    app = Flask(__name__); app.secret_key = secrets.token_hex(16)
    inputs = os.path.join(workspace, "inputs"); out_dir = os.path.join(workspace, "out"); os.makedirs(out_dir, exist_ok=True)
    user = cfg.get("user", {"username": "analyst", "password": "analyst"})
    records = cfg.get("records", {}); forms = {f["id"]: f for f in cfg.get("forms", [])}
    docs = cfg.get("documents", [])
    nav = "".join(f'<a href="/records/{k}">{k.title()}</a>' for k in records)
    def page(body): return HTML.format(org=cfg.get("org", "Portal"), nav=nav, body=body)
    def authed(): return session.get("u") == user["username"]
    @app.before_request
    def _gate():
        if request.path.startswith(("/login", "/static", "/health")): return None
        if not authed(): return redirect("/login")
    @app.route("/health")
    def health(): return jsonify({"ok": True, "org": cfg.get("org"), "documents": len(docs), "records": {k: len(v) for k, v in records.items()}, "forms": list(forms)})
    @app.route("/login", methods=["GET", "POST"])
    def login():
        if request.method == "POST":
            if request.form.get("username") == user["username"] and request.form.get("password") == user["password"]:
                session["u"] = user["username"]; return redirect("/")
            return page("<p style='color:red'>Invalid credentials.</p>" + LOGIN), 401
        return page(LOGIN)
    @app.route("/logout")
    def logout(): session.clear(); return redirect("/login")
    @app.route("/")
    def home():
        return page(f"<p>Welcome, {user['username']}. {cfg.get('welcome', '')}</p><ul><li><a href='/documents'>Document library</a> ({len(docs)} documents)</li>" + "".join(f"<li><a href='/records/{k}'>{k}</a> ({len(v)} records)</li>" for k, v in records.items()) + f"<li><a href='/forms'>Forms</a> ({len(forms)})</li></ul>")
    @app.route("/documents")
    def documents():
        rows = "".join(f"<tr><td>{d['id']}</td><td><a href='/documents/{d['id']}/download'>{d['title']}</a></td><td>{d.get('category', '')}</td></tr>" for d in docs)
        return page(f"<h2>Document library</h2><table><tr><th>ID</th><th>Title</th><th>Category</th></tr>{rows}</table>")
    @app.route("/documents/<doc_id>/download")
    def download(doc_id):
        d = next((x for x in docs if x["id"] == doc_id), None)
        if not d: abort(404)
        rel = d["path"]; full = os.path.normpath(os.path.join(inputs, rel))
        if not full.startswith(os.path.normpath(inputs)): abort(403)
        return send_from_directory(os.path.dirname(full), os.path.basename(full), as_attachment=True)
    @app.route("/api/documents")
    def api_docs(): return jsonify(docs)
    @app.route("/records/<entity>")
    def rec_html(entity):
        rows = records.get(entity)
        if rows is None: abort(404)
        cols = list(rows[0].keys()) if rows else []
        body = "".join("<tr>" + "".join(f"<td>{r.get(c, '')}</td>" for c in cols) + "</tr>" for r in rows[:2000])
        return page(f"<h2>{entity}</h2><p>JSON: <a href='/api/{entity}'>/api/{entity}</a></p><table><tr>" + "".join(f"<th>{c}</th>" for c in cols) + f"</tr>{body}</table>")
    @app.route("/api/<entity>")
    def rec_json(entity):
        if entity not in records: abort(404)
        return jsonify(records[entity])
    @app.route("/forms")
    def forms_index():
        return page("<h2>Forms</h2><ul>" + "".join(f"<li><a href='/forms/{k}'>{f['title']}</a></li>" for k, f in forms.items()) + "</ul>")
    @app.route("/forms/<form_id>", methods=["GET", "POST"])
    def form(form_id):
        f = forms.get(form_id)
        if not f: abort(404)
        if request.method == "POST":
            data = request.get_json(silent=True) or {k: v for k, v in request.form.items()}
            rec = {"form_id": form_id, "submitted_utc": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "data": data}
            p = os.path.join(out_dir, "portal_submissions.json")
            cur = json.load(open(p)) if os.path.exists(p) else []
            cur.append(rec); json.dump(cur, open(p, "w"), indent=1)
            if request.is_json: return jsonify({"ok": True, "submission": rec})
            return page(f"<h2>{f['title']}</h2><p style='color:green'>Submission recorded.</p><pre>{json.dumps(rec, indent=1)}</pre>")
        fields = "".join(f"<p><label>{x.get('label', x['name'])}<br><input name='{x['name']}' type='{'number' if x.get('type') in ('number', 'float', 'int') else 'text'}' step='any'></label></p>" for x in f["fields"])
        return page(f"<h2>{f['title']}</h2><form method='post'>{fields}<button type='submit'>Submit</button></form><p>API: POST JSON to this URL.</p>")
    return app

LOGIN = "<h2>Sign in</h2><form method='post'><p><label>Username<br><input name='username'></label></p><p><label>Password<br><input name='password' type='password'></label></p><button type='submit'>Sign in</button></form>"

def main():
    ap = argparse.ArgumentParser(); ap.add_argument("--workspace", required=True); ap.add_argument("--port", type=int, required=True)
    a = ap.parse_args()
    app = make_app(a.workspace)
    app.run(host="127.0.0.1", port=a.port, debug=False, use_reloader=False, threaded=True)

if __name__ == "__main__":
    main()