"""
ncfca/governance/genesis.py

Genesis Burn-in / Verified Initializer.
Ensures every system instance starts from a cryptographically verified,
immutable foundation to prevent "Genesis Poisoning".
"""

from __future__ import annotations
import hashlib
import json
from dataclasses import dataclass, field
from datetime import datetime
from typing import Dict, Any, Optional


@dataclass
class GenesisState:
    """Represents a verified genesis (initial) state."""
    version: str = "1.0"
    timestamp: str = field(default_factory=lambda: datetime.utcnow().isoformat())
    hash: str = ""
    metadata: Dict[str, Any] = field(default_factory=dict)
    is_verified: bool = False


class GenesisBurnIn:
    """
    Performs a verified initialization of the system.
    Flushes volatile state and creates an immutable foundation.
    """

    def __init__(self, secret: str = "ncfca-genesis-v1"):
        self.secret = secret
        self.genesis_state: Optional[GenesisState] = None

    def _compute_hash(self, data: Dict[str, Any]) -> str:
        """Create a tamper-evident hash of the initialization data."""
        serialized = json.dumps(data, sort_keys=True).encode("utf-8")
        return hashlib.sha256(serialized + self.secret.encode()).hexdigest()

    def burn_in(self, metadata: Optional[Dict[str, Any]] = None) -> GenesisState:
        """
        Execute the Genesis Burn-in process.
        Returns a verified GenesisState.
        """
        metadata = metadata or {}

        # Core verified initialization data
        init_data = {
            "version": "1.0",
            "timestamp": datetime.utcnow().isoformat(),
            "secret_fingerprint": hashlib.sha256(self.secret.encode()).hexdigest()[:16],
            "metadata": metadata,
        }

        genesis_hash = self._compute_hash(init_data)

        self.genesis_state = GenesisState(
            version=init_data["version"],
            timestamp=init_data["timestamp"],
            hash=genesis_hash,
            metadata=metadata,
            is_verified=True,
        )

        return self.genesis_state

    def verify(self, state: GenesisState) -> bool:
        """Verify that a GenesisState has not been tampered with."""
        if not state.is_verified:
            return False

        # Recompute hash and compare
        # FIX: was missing secret_fingerprint, which IS part of what burn_in()
        # actually hashed — meant verify() always returned False, even for
        # completely legitimate, untampered state. Caught by testing directly.
        data_to_verify = {
            "version": state.version,
            "timestamp": state.timestamp,
            "secret_fingerprint": hashlib.sha256(self.secret.encode()).hexdigest()[:16],
            "metadata": state.metadata,
        }
        expected_hash = self._compute_hash(data_to_verify)
        return expected_hash == state.hash

    def get_state(self) -> Optional[GenesisState]:
        return self.genesis_state