#!/usr/bin/env python3
"""Root intake of two original internal Bank writes, not external bank auth."""
import hashlib
import json
import subprocess
import sys
from pathlib import Path
import integrate_20261010 as tool
from integrate_20261011_batches46_48 import item

HERE = Path(__file__).resolve().parent
REVIEW = Path('/private/tmp/cdx-ai-hk-course-b.Kmdirn/review-s2-421-433/verify_review.py')
REPORT = tool.AI + 'parallel-bank-login-20261013/ROOT_REVIEW.md'


def verify():
    assert hashlib.sha256(REVIEW.read_bytes()).hexdigest() == '2325f6f1bdda87a313219ed63759a1e39a4f308e3fe7d6066db3eecde45c4d73'
    result = json.loads(subprocess.check_output([sys.executable, '-B', str(REVIEW)]))
    assert result['verified_bounded_evidence'] and result['checks'] == 1361
    assert result['author_verifier']['checks'] == 17957
    assert result['available_business_HTTP_raw'] == 32 and result['isolated_router_attempts_missing_raw'] == 2
    assert result['business_DML_total'] == 22 and result['assets'] == 169
    assert result['author_verifier']['total_http_per_side'] == 17
    for path, digest in result['source_pins'].items():
        if path == 'config/cache.php':
            assert digest == '98fa13484feb3db94bc4ebdd3de2f0b4ebc2c80d1cccb7a283a16f45eb9095a4'
            continue  # Exact private single-line cache boundary checked by sealed reviewer.
        data = subprocess.check_output(['git', '-C', str(tool.source_root('ai_api')), 'show', result['source_commit'] + ':' + path])
        assert hashlib.sha256(data).hexdigest() == digest


if __name__ == '__main__':
    audit = HERE / 'integration-20261013-bank-login.json'
    assert not audit.exists(), 'Never replay main'
    rows = [item('ai_api', 'POST', '/api/bank/' + action, '', evidence=REPORT,
        risk='new-owned-internal-relationship-and-user-login-timestamps-no-real-bank',
        success_case='partial-evidence-original-internal-switch-or-bind-positive-and-owned-negative-branches',
        readback='tested-pass-exact-user-and-relation-PK-mutations-complete-own-seven-table-protection',
        parity='partial-evidence-full-JSON-types-values-five-tokens-per-side-originally-verified-and-removed',
        cleanup='owned-marked-rows-retained-private-cache-tokens-removed-router-missing-raw-preserved')
        for action in ['switchLoginUser', 'bindUserLogin']]
    rows.append(item('ai_api', 'POST', '/api/bank/currentLoginUser', '', evidence=REPORT, evidence_only=True))
    tool.main(rows, audit, verify)