"""Offline intake shared by Windows and Linux desktops. No code is executed."""
import json
from pathlib import Path

from samsara.models.inventory import validate_inventory, restrict_inventory_fields

MAX_IMPORT_BYTES = 10 * 1024 * 1024


def load_inventory(path):
    with Path(path).open('rb') as source:
        raw = source.read(MAX_IMPORT_BYTES + 1)
    if len(raw) > MAX_IMPORT_BYTES:
        raise ValueError('Inventory exceeds the 10 MiB import limit.')
    try:
        data = json.loads(raw.decode('utf-8-sig'))
    except (ValueError, UnicodeError):
        raise ValueError('The selected file is not valid UTF-8 inventory JSON.') from None
    # A report wrapper is accepted, but its precomputed assessment is never trusted.
    if isinstance(data, dict) and 'inventory_result' in data:
        data = data['inventory_result']
    validate_inventory(data)
    # Keep diagnostic contents out of logs and exported reports. Diagnostics may
    # contain command lines or credentials from external collection tools.
    safe_errors = {
        'access_denied': 'Current account could not read this scope.',
        'command_unavailable': 'Required command was unavailable.',
        'timeout': 'Section time limit exceeded.',
        'overall_timeout': 'Overall collection time limit exceeded.',
        'output_limit': 'Collection output limit exceeded.',
        'powershell_failed': 'PowerShell could not execute the collector.',
        'invalid_output': 'Invalid section output.',
        'collection_failed': 'A local query failed.'
    }
    checks = {}
    for name, check in data['checks'].items():
        clean = {'status': check['status'], 'message':
                 'Imported check status. Source assertions are unverified; raw diagnostics excluded.'}
        for field in ('started_at', 'completed_at'):
            if field in check:
                clean[field] = check[field]
        if 'errors' in check:
            clean['errors'] = []
            for error in check['errors']:
                code = error['code'] if error['code'] in safe_errors else 'collection_failed'
                clean['errors'].append({'code': code, 'scope': 'Imported check', 'message': safe_errors[code]})
        if 'permission_limitations' in check:
            clean['permission_limitations'] = ['Collector reported limited read access; details excluded.'] if check['permission_limitations'] else []
        if 'limitations' in check:
            clean['limitations'] = ['Collector reported scope limitations; consult the inventory owner.'] if check['limitations'] else []
        checks[name] = clean
    data['checks'] = checks
    return restrict_inventory_fields(data)