"""Rebuild pinned upstream SSO for Jellyfin 12.2 in an isolated Docker SDK.

Run on a Linux build host with Docker. Does not install or configure the plugin.
"""
import io
import pathlib
import shutil
import subprocess
import tempfile
import urllib.request
import zipfile

UPSTREAM = "f1e157bac29e6d27a0844378f3e1d4a4fdaa577a"
root = pathlib.Path(tempfile.mkdtemp(prefix="jellyfin-sso12-"))
archive = urllib.request.urlopen(
    f"https://codeload.github.com/9p4/jellyfin-plugin-sso/zip/{UPSTREAM}", timeout=90
).read()
with zipfile.ZipFile(io.BytesIO(archive)) as zipped:
    for item in zipped.infolist():
        relative = pathlib.PurePosixPath(item.filename).parts[1:]
        if not relative or item.is_dir():
            continue
        target = root.joinpath(*relative)
        if not target.resolve().is_relative_to(root.resolve()):
            raise ValueError("Unsafe archive path")
        target.parent.mkdir(parents=True, exist_ok=True)
        target.write_bytes(zipped.read(item))
for project in list(root.rglob("*.csproj")) + list(root.rglob("*.fsproj")):
    text = project.read_text(encoding="utf-8-sig")
    text = text.replace("net9.0", "net10.0").replace("net8.0", "net10.0")
    text = text.replace('Version="10.11.0"', 'Version="12.2.0"')
    text = text.replace(
        '<PackageReference Include="System.Security.Cryptography.Xml" Version="6.0.1" />',
        '<PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.0" />',
    )
    project.write_text(text, encoding="utf-8")
subprocess.run(
    ["docker", "run", "--rm", "--cpus=2", "-v", f"{root}:/src", "-w", "/src",
     "mcr.microsoft.com/dotnet/sdk:10.0", "dotnet", "build", "SSO-Auth", "-c", "Release",
     "-p:CopyLocalLockFileAssemblies=true", "-o", "/src/build"], check=True,
)
package = root / "package"
package.mkdir()
# Jellyfin provides its own assemblies. Include only SSO's additional runtime dependencies.
for name in ["SSO-Auth.dll", "Lib.dll", "FSharp.Core.dll",
             "Duende.IdentityModel.OidcClient.dll", "Duende.IdentityModel.dll"]:
    shutil.copy2(root / "build" / name, package / name)
for license_file in root.glob("LICENSE*"):
    shutil.copy2(license_file, package / license_file.name)
print(f"SSO source: {UPSTREAM}; package: {package}")