# -*- coding: utf-8 -*-
"""REQ-通用-006 预生产测试通道 — nginx /api/dev/ 内网闸门注入脚本（幂等）"""
import shutil
import sys

NGINX_CONF = "/opt/wecom-it-desk/nginx/nginx.conf"
BAK = "/opt/wecom-it-desk/nginx/nginx.conf.bak-testch-20260811"

GATE_BLOCK = """        # ============================================================
        # 预生产测试通道 (REQ-通用-006) - nginx 内网闸门
        # 仅内网可访问 /api/dev/*，公网 403。部署后须双向 curl 验证
        # ============================================================
        location /api/dev/ {
            allow 10.0.0.0/8;
            allow 172.16.0.0/12;
            allow 192.168.0.0/16;
            deny all;
            proxy_pass http://backend_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

"""


def main() -> int:
    with open(NGINX_CONF, encoding="utf-8") as f:
        src = f.read()

    if "location /api/dev/" in src:
        print("ALREADY_EXISTS")
        return 0

    anchor = "location /api/ {\n"
    idx = src.find(anchor)
    if idx < 0:
        print("ANCHOR_NOT_FOUND")
        return 1

    shutil.copy2(NGINX_CONF, BAK)
    new_src = src[:idx] + GATE_BLOCK + src[idx:]
    with open(NGINX_CONF, "w", encoding="utf-8") as f:
        f.write(new_src)
    print("INSERTED_OK")
    return 0


if __name__ == "__main__":
    sys.exit(main())