#!/usr/bin/python3
"""Fixed-path entry point for Secure DNS policy activation."""

import json
import os
import subprocess
import sys

from octava_secure_dns_apply import ApplyError, RELEASES_DIRECTORY, apply_prepared_release


def main() -> int:
    if len(sys.argv) != 2 or sys.argv[1] != "apply":
        raise SystemExit("usage: octava-secure-dns-policy-control apply")
    if os.geteuid() != 0:
        raise SystemExit("octava-secure-dns-policy-control must run as root")
    try:
        process = subprocess.run(
            ["/usr/libexec/octava-secure-dns-policy-prepare", "prepare"],
            text=True,
            capture_output=True,
            timeout=60,
            check=False,
            env={"PATH": "/usr/sbin:/usr/bin:/sbin:/bin"},
        )
        if process.returncode != 0:
            raise ApplyError("Secure DNS candidate preparation failed")
        try:
            prepared = json.loads(process.stdout)
        except json.JSONDecodeError as exc:
            raise ApplyError("Secure DNS preparer returned invalid output") from exc
        result = apply_prepared_release(prepared["release_id"])
        print(json.dumps(result, sort_keys=True))
        return 0
    except (ApplyError, OSError) as exc:
        print(str(exc), file=sys.stderr)
        return 1


if __name__ == "__main__":
    raise SystemExit(main())
