"""Finite loopback-only HTTP/3 WebTransport receiver for native security proof."""
import asyncio, datetime, hashlib, ipaddress, json, os, pathlib, sys
from aioquic.asyncio import QuicConnectionProtocol, serve
from aioquic.h3.connection import H3Connection, H3_ALPN
from aioquic.h3.events import HeadersReceived, DatagramReceived, WebTransportStreamDataReceived
from aioquic.quic.configuration import QuicConfiguration
from aioquic.quic.events import ProtocolNegotiated
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.x509.oid import NameOID

facts = {"packets": 0, "connections": 0, "datagrams": 0, "streams": 0, "bytes": 0, "workerBytes": 0, "marker": False}
marker = b"SYNTHETIC_WEBTRANSPORT_DLP_MARKER"
class Receiver(QuicConnectionProtocol):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.http = None
        self.worker_sessions = set()
    def datagram_received(self, data, addr):
        facts["packets"] += 1
        super().datagram_received(data, addr)
    def quic_event_received(self, event):
        if isinstance(event, ProtocolNegotiated):
            self.http = H3Connection(self._quic, enable_webtransport=True)
        if not self.http:
            return
        for item in self.http.handle_event(event):
            if isinstance(item, HeadersReceived):
                headers = dict(item.headers)
                if headers.get(b":method") == b"CONNECT" and headers.get(b":protocol") == b"webtransport":
                    facts["connections"] += 1
                    if headers.get(b":path", b"").endswith(b"/worker"):
                        self.worker_sessions.add(item.stream_id)
                    self.http.send_headers(item.stream_id, [(b":status", b"200"), (b"sec-webtransport-http3-draft", b"draft02")])
                    self.transmit()
            elif isinstance(item, (DatagramReceived, WebTransportStreamDataReceived)):
                facts["datagrams" if isinstance(item, DatagramReceived) else "streams"] += 1
                facts["bytes"] += len(item.data)
                session_id = item.stream_id if isinstance(item, DatagramReceived) else item.session_id
                if session_id in self.worker_sessions:
                    facts["workerBytes"] += len(item.data)
                facts["marker"] |= marker in item.data

async def main():
    root = pathlib.Path(sys.argv[1]).resolve()
    root.mkdir(parents=True, exist_ok=True)
    key = ec.generate_private_key(ec.SECP256R1())
    now = datetime.datetime.now(datetime.timezone.utc)
    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "127.0.0.1")])
    cert = x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-datetime.timedelta(minutes=1)).not_valid_after(now+datetime.timedelta(days=7)).add_extension(x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address("127.0.0.1"))]), critical=False).sign(key, hashes.SHA256())
    cert_file, key_file = root / "certificate.pem", root / "key.pem"
    cert_file.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
    key_file.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, serialization.NoEncryption()))
    config = QuicConfiguration(is_client=False, alpn_protocols=H3_ALPN, max_datagram_frame_size=65536)
    config.load_cert_chain(str(cert_file), str(key_file))
    server = await serve("127.0.0.1", 0, configuration=config, create_protocol=Receiver)
    async def stats(reader, writer):
        await reader.read(8192)
        body = json.dumps(facts).encode()
        writer.write(b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: " + str(len(body)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
        await writer.drain()
        writer.close()
    control = await asyncio.start_server(stats, "127.0.0.1", 0)
    print(json.dumps({"quicPort": server._transport.get_extra_info("sockname")[1], "statsPort": control.sockets[0].getsockname()[1], "hash": hashlib.sha256(cert.public_bytes(serialization.Encoding.DER)).hexdigest(), "aioquic": __import__("aioquic").__version__}), flush=True)
    await asyncio.sleep(180)
    server.close()
    control.close()

if __name__ == "__main__":
    asyncio.run(main())