#!/usr/bin/env python3
"""Codex HTTP header helper. Stdout is private protocol data, never a diagnostic log."""

import json
import os
import stat
import sys
from pathlib import Path

profile = Path(sys.argv[1]).expanduser()
server_url = sys.argv[2].rstrip("/")
try:
    descriptor = os.open(profile, os.O_RDONLY | os.O_NOFOLLOW)
except FileNotFoundError:
    print("{}")  # Enables initial public discovery and signup.
    raise SystemExit(0) from None
with os.fdopen(descriptor) as handle:
    metadata = os.fstat(handle.fileno())
    if metadata.st_uid != os.getuid() or metadata.st_mode & 0o077:
        raise SystemExit("Credential profile must be owned by you and have mode 0600")
    if not stat.S_ISREG(metadata.st_mode) or metadata.st_size > 64 * 1024:
        raise SystemExit("Invalid credential profile")
    data = json.load(handle)
if data.get("service_url", "").rstrip("/") != server_url:
    raise SystemExit("Credential profile belongs to a different service")
token = data.get("api_key") or data.get("access_token")
if not isinstance(token, str) or not token.startswith("pdb_") or len(token) > 256:
    raise SystemExit("Credential profile has no valid token")
print(json.dumps({"Authorization": "Bearer " + token}))