import sys
import xml.etree.ElementTree as ET
import os
dump_file = sys.argv[1]
cache_file = sys.argv[2]
key_file = sys.argv[3]
ttl_sec = sys.argv[4]
pve_endpoint = sys.argv[5]
vault_addr = sys.argv[6]
tree = ET.parse(dump_file)
root = tree.getroot()
for h in root.findall(".//History"):
    h.clear()
for g in root.findall(".//Group"):
    name = g.find("./Name")
    if name is not None and name.text == "Recycle Bin":
        g.clear()
entries = {}
for entry in root.findall(".//Entry"):
    title = ""
    username = ""
    password = ""
    notes = ""
    for string in entry.findall("./String"):
        key_elem = string.find("./Key")
        val_elem = string.find("./Value")
        if key_elem is not None and val_elem is not None and key_elem.text:
            k = key_elem.text
            v = val_elem.text or ""
            if k == "Title": title = v.strip()
            elif k == "UserName": username = v.strip()
            elif k == "Password": password = v.strip()
            elif k == "Notes": notes = v.strip()
    if title and title not in entries:
        entries[title] = {
            "username": username,
            "password": password,
            "notes": notes
        }
ssh_loaded = False
for title in ("Atlas Core Key", "AtlasCoreKey", "Atlas Core"):
    entry_data = entries.get(title, {})
    for field in ("password", "notes"):
        val = entry_data.get(field, "")
        if "-----BEGIN" in val or "PRIVATE KEY" in val:
            with open(key_file, "w") as kf:
                kf.write(val.strip() + "\n")
            os.chmod(key_file, 0o600)
            ssh_loaded = True
            break
    if ssh_loaded:
        break
if not ssh_loaded:
    sys.stderr.write("Внимание: приватный SSH-ключ не найден в полях Password/Notes записи Atlas Core Key.\n")
with open(cache_file, "w") as f:
    f.write(f"# TTL_SECONDS={ttl_sec}\n")
    f.write(f"export PROXMOX_VE_API_TOKEN={repr(entries.get('ProxmoxAPI', {}).get('password', ''))}\n")
    f.write(f"export TF_VAR_proxmox_api_token={repr(entries.get('ProxmoxAPI', {}).get('password', ''))}\n")
    f.write(f"export TF_VAR_state_passphrase={repr(entries.get('TofuState', {}).get('password', ''))}\n")
    f.write(f"export PROXMOX_VE_ENDPOINT={repr(pve_endpoint)}\n")
    f.write(f"export VAULT_ADDR={repr(vault_addr)}\n")
    f.write(f"export VAULT_TOKEN={repr(entries.get('OpenBaoToken', {}).get('password', ''))}\n")
    f.write(f"export VAULT_UNSEAL_KEY={repr(entries.get('OpenBaoUnseal', {}).get('password', ''))}\n")
    f.write(f"export TECHNITIUM_PASSWORD={repr(entries.get('Technitium', {}).get('password', 'admin'))}\n")
    f.write(f"export TF_VAR_vaultwarden_admin_token={repr(entries.get('VaultwardenAdmin', {}).get('password', ''))}\n")
    f.write(f"export TF_VAR_forgejo_runner_token={repr(entries.get('ForgejoRunnerToken', {}).get('password', ''))}\n")
    f.write(f"export TF_VAR_forgejo_oidc_client_id={repr(entries.get('ForgejoOIDC', {}).get('username', 'forgejo'))}\n")
    f.write(f"export TF_VAR_forgejo_oidc_secret={repr(entries.get('ForgejoOIDC', {}).get('password', ''))}\n")
    f.write(f"export ATLAS_PUSH_TOKEN={repr(entries.get('AtlasPushToken', {}).get('password', ''))}\n")
    f.write(f"export VYOS_WG_PRIVATE_KEY={repr(entries.get('VyosWG', {}).get('password', ''))}\n")
os.chmod(cache_file, 0o600)