"""Schema reference for `integration.conf`.

Values are always returned as strings by `BaseConfig.get`. Type parsing
(int, int list, bool, rule-id map) is the caller's responsibility. The
format columns below are advisory conventions shared between producers
(wizard, installers, panel templates) and consumers, not runtime-enforced
schemas.

Validation today is narrow: `other/compatibility-check.sh` validates INI
syntax, `[paths] ui_path`, and the `panel_info` script at install time;
integration-script JSON outputs are validated at runtime via Cerberus
schemas under `panels/generic/users_script_schemas/`. All other keys are
read on demand and trusted.

Non-obvious `.get()` behavior:
- Missing file returns `None` (ConfigParser.read silently ignores missing
  paths; use `BaseConfig.exists()` to distinguish).
- Malformed INI propagates `configparser.Error`; `.get()` only catches
  `KeyError`.
- Section names are case-sensitive (ConfigParser default); option names
  are case-insensitive. Match the casing documented below.

Sections
--------

`[PAM]`
    - `SERVICE_NAME` (str): PAM service used for UI login
      authentication.

`[panel]`
    - `type` (str, `cpanel`|`plesk`|`directadmin`|`generic`):
      master switch for panel class selection.

`[panel_ports]`
    Comma-separated integer lists (e.g. `2082, 2095`). Empty or absent
    means "no ports of this class".

    - `http_ports`: ports the panel listens on for HTTP admin traffic.
    - `https_ports`: HTTPS equivalents.
    - `webshield_protected_ports`: subset of the above that WebShield
      should protect.

`[panel_login]`
    - `ossec_rules` (str, comma-separated `rule_id:bool` pairs, e.g.
      `11006:false,11009:true`): OSSEC rule IDs to auto-whitelist for
      panel-login events.

`[features]`
    Boolean feature flags. Conventional values: `true` / `false`
    (case-insensitive).

    - `webshield_enabled` (bool)
    - `cphulk_enabled` (bool)

`[smtp]`
    - `allow_users` (str, comma-separated list of usernames): system
      users allowed to send SMTP when the SMTP block feature is active.
    - `conflict_config_file` (str, absolute path): panel config file
      whose value toggles the SMTP-block conflict check.
    - `conflict_config_key` (str): key inside `conflict_config_file`
      that holds the conflicting setting.

`[web_server]`
    - `server_type` (str, `apache`|`nginx`|...): web server in use.
    - `modsec_audit_log` (str, absolute path): ModSecurity audit log
      file.
    - `modsec_audit_logdir` (str, absolute path): ModSecurity audit log
      directory (concurrent writer layout).
    - `graceful_restart_script` (str, command string): whitespace-split
      command used to gracefully restart the web server
      (e.g. `/usr/bin/systemctl restart apache2`).
    - `config_test_script` (str, command string): whitespace-split
      command used to validate the web server configuration before
      reload (e.g. `/usr/sbin/apache2ctl -t`).

`[integration_scripts]`
    Values are absolute paths to scripts executed by the agent as root.
    Populate with trusted, integrator-controlled paths only; do not
    interpolate user-controlled data.

    - `users` (str path): emits JSON user list.
    - `domains` (str path): emits JSON domain -> owner mapping.
    - `admins` (str path): emits JSON admin list.
    - `panel_info` (str path): emits JSON `{name, version, ...}`
      describing the panel.
    - `modsec_domain_config_script` (str path): emits per-domain
      ModSecurity overrides.

`[paths]`
    - `ui_path` (str, absolute path): document root for the standalone
      UI.
    - `ui_path_owner` (str, `user:group`): owner applied to UI files
      during install.

`[malware]`
    - `basedir` (str, **whitespace-separated** paths): base directories
      scanned for malware. Note the separator differs from port lists
      (whitespace here, comma for port lists).

`[metadata]`
    - `schema_version` (int): schema version number.
    - `created_by` (str, `wizard`|`agent`|`manual`): who wrote the file;
      useful for support triage.
"""

import os
from typing import Optional

from defence360agent.application.determine_hosting_panel import GP_FILE


class BaseConfig:
    @classmethod
    def exists(cls):
        return os.path.exists(cls._conf_path)

    @classmethod
    def to_dict(cls):
        from configparser import ConfigParser

        integration_conf = ConfigParser()
        integration_conf.read(cls._conf_path)

        return integration_conf

    @classmethod
    def get(cls, section: str, option: str) -> Optional[str]:
        """
        Return *option* value in *section* in config if exist,
        None otherwise.
        """
        try:
            return cls.to_dict()[section][option]
        except KeyError:
            return None


class IntegrationConfig(BaseConfig):
    _conf_path = GP_FILE


class ClIntegrationConfig(BaseConfig):
    _conf_path = "/opt/cpvendor/etc/integration.ini"