"""IAM teaching application. Uses ADC; never returns secret contents."""
import csv
import io
import json
import os
import uuid
from decimal import Decimal
from flask import Flask, jsonify
from google.cloud import secretmanager, storage

app = Flask(__name__)

@app.post('/report')
def report():
    stage = 'read_input'
    request_id = uuid.uuid4().hex
    try:
        client = storage.Client()
        raw = client.bucket(os.environ['INPUT_BUCKET']).blob('input.csv').download_as_text()
        rows = list(csv.DictReader(io.StringIO(raw)))
        total = sum((Decimal(row['amount']) for row in rows), Decimal('0'))
        stage = 'read_secret'
        secretmanager.SecretManagerServiceClient().access_secret_version(
            request={'name': os.environ['SECRET_VERSION']})
        stage = 'write_report'
        name = f'reports/{request_id}.json'
        result = {'rows': len(rows), 'total': str(total), 'request_id': request_id}
        client.bucket(os.environ['OUTPUT_BUCKET']).blob(name).upload_from_string(
            json.dumps(result), content_type='application/json', if_generation_match=0)
        print(json.dumps({'request_id': request_id, 'stage': 'complete'}), flush=True)
        return jsonify({**result, 'object': name})
    except Exception as error:
        # Record the operation and error class; never log tokens or secret payloads.
        print(json.dumps({'request_id': request_id, 'stage': stage,
                          'error_type': type(error).__name__}), flush=True)
        return jsonify(request_id=request_id, stage=stage,
                       error_type=type(error).__name__), 500

if __name__ == '__main__':
    app.run(host='127.0.0.1', port=int(os.environ.get('PORT', '8080')))