# ==============================================================================
# Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ==============================================================================
"""
Override CA uninstaller.

Reads the install-marker JSON (or partial-marker recovery file) written by
:mod:`cfnbootstrap._ca_install_win`, calls ``certutil -delstore`` for each
recorded entry, and removes the marker file.

Public surface:

    uninstall_all(marker_path=None)
    main(argv=None)            -- script entrypoint used by bin/cfn-ca-uninstall

Idempotent: no-op when no marker is present. Best-effort: a missing cert in
the Windows store is logged and continued, not raised. We NEVER remove a
cert that is not listed in our marker (or partial-marker) -- that protects
operator-installed CAs.
"""
import argparse
import logging
import os
import sys
from typing import List, Optional

from cfnbootstrap._ca_install import CaOverrideError

log = logging.getLogger('cfn.init')
_LOG_PREFIX = '[CaOverrideInstall]'


def _default_marker_path() -> str:
    """Resolve the install-marker path, honouring the test seam env var."""
    override = os.environ.get('CFN_CA_OVERRIDE_MARKER_PATH')
    if override:
        return override
    return os.path.expandvars(r'${SystemDrive}\cfn\state\ca-install-marker.json')


def uninstall_all(marker_path: Optional[str] = None) -> None:
    """Uninstall every override CA recorded in the marker.

    Args:
        marker_path: Override the default marker path. When ``None``, the
            default is resolved from ``CFN_CA_OVERRIDE_MARKER_PATH`` or
            ``%SystemDrive%\\cfn\\state\\ca-install-marker.json``.

    Raises:
        CaOverrideError: on hard failures (certutil missing, certutil call
            failures that are not "cert not in store"). cfn-ca-uninstall's
            ``main()`` translates these to a non-zero exit code.
    """
    if marker_path is None:
        marker_path = _default_marker_path()

    if os.name != 'nt':
        # Linux: no marker is ever written. The override PEM file itself is
        # the install marker; if the operator wants to "uninstall" they just
        # delete /etc/cfn/ca-override.pem. cfn-ca-uninstall is therefore a
        # no-op on Linux. We log so the operator sees confirmation rather
        # than silent success.
        log.info(
            '%s cfn-ca-uninstall is a no-op on non-Windows hosts; the '
            'override PEM file itself is the install marker on Linux. '
            'Remove the PEM to disable.', _LOG_PREFIX,
        )
        return

    # Local import keeps the Linux dispatch path import-clean.
    from cfnbootstrap import _ca_install_win
    _ca_install_win.uninstall_all_from_marker(marker_path)


def _configure_logging(quiet: bool) -> None:
    """Minimal logging config used by the CLI entrypoint.

    Mirrors the lightweight pattern used by the other bin/cfn-* tools.
    """
    level = logging.WARNING if quiet else logging.INFO
    root = logging.getLogger()
    if not root.handlers:
        handler = logging.StreamHandler(sys.stderr)
        handler.setFormatter(
            logging.Formatter('%(asctime)s [%(levelname)s] %(message)s'),
        )
        root.addHandler(handler)
    root.setLevel(level)
    logging.getLogger('cfn.init').setLevel(level)


def main(argv: Optional[List[str]] = None) -> int:
    """CLI entrypoint for ``cfn-ca-uninstall``.

    Returns:
        ``0`` on success, non-zero on hard failure. A clear human-readable
        diagnostic is printed to stderr on failure.
    """
    parser = argparse.ArgumentParser(
        prog='cfn-ca-uninstall',
        description=(
            'Uninstall override CA(s) previously installed by cfn-bootstrap. '
            'Reads the install-marker JSON, calls certutil -delstore for '
            'each recorded entry, and removes the marker file. Idempotent.'
        ),
    )
    parser.add_argument(
        '--marker-path',
        default=None,
        help=(
            'Override the install-marker path. Defaults to '
            'CFN_CA_OVERRIDE_MARKER_PATH env var or '
            r'%%SystemDrive%%\cfn\state\ca-install-marker.json.'
        ),
    )
    parser.add_argument(
        '--quiet', '-q', action='store_true',
        help='Suppress INFO logging; only WARNING+ are emitted.',
    )
    args = parser.parse_args(argv)

    _configure_logging(args.quiet)

    try:
        uninstall_all(marker_path=args.marker_path)
    except CaOverrideError as exc:
        sys.stderr.write(exc.message + '\n')
        sys.stderr.write('cfn-ca-uninstall failed (kind=%s)\n' % exc.kind)
        return 2
    except Exception as exc:  # noqa: BLE001 -- top-level CLI safety net
        sys.stderr.write(
            '%s unexpected error: %s: %s\n'
            % (_LOG_PREFIX, type(exc).__name__, exc)
        )
        return 3
    return 0


if __name__ == '__main__':  # pragma: no cover -- script entrypoint
    sys.exit(main())