#!/usr/bin/env python3
"""Remove only the approved functions from php.ini disable_functions."""

import argparse
import shutil
from pathlib import Path


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--php-ini", type=Path, required=True)
    parser.add_argument("--required-functions", required=True)
    parser.add_argument("--backup", type=Path, required=True)
    args = parser.parse_args()

    allowed = [item.strip() for item in args.required_functions.split(",") if item.strip()]
    approved = {"exec", "readlink", "popen", "proc_open", "proc_get_status"}
    if not allowed or set(allowed) - approved:
        raise ValueError("PHP_REQUIRED_FUNCTIONS contains an unapproved function")

    lines = args.php_ini.read_text(encoding="utf-8").splitlines()
    found = False
    output = []
    for line in lines:
        stripped = line.lstrip()
        if stripped.startswith(";") or "=" not in line:
            output.append(line)
            continue
        key, value = line.split("=", 1)
        if key.strip() != "disable_functions":
            output.append(line)
            continue
        if found:
            raise ValueError("multiple active disable_functions directives")
        disabled = [item.strip() for item in value.split(",") if item.strip()]
        remaining = [item for item in disabled if item not in allowed]
        output.append("disable_functions = " + ",".join(remaining))
        found = True
    if not found:
        raise ValueError("active disable_functions directive not found")

    args.backup.parent.mkdir(parents=True, exist_ok=True)
    shutil.copy2(args.php_ini, args.backup)
    args.php_ini.write_text("\n".join(output) + "\n", encoding="utf-8")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())