"""Trusted Mac operator: locate a private mock reset capture, without printing codes."""
import argparse
import json
import time
from pathlib import Path
from backend.containment import install_guard
from backend.recovery import local_path,read_db
from backend.store import digest


def main():
    parser=argparse.ArgumentParser(description='Locate a locally captured recovery code. No mail is sent. Output is a private file path, never the code.')
    parser.add_argument('--data-dir',required=True,type=Path)
    parser.add_argument('--email',required=True)
    args=parser.parse_args();install_guard();root=local_path(args.data_dir)
    try:
        with read_db(root/'registry.sqlite3') as db:
            row=db.execute("SELECT id,token_hash FROM access_tokens WHERE kind='reset' AND email=? AND used=0 AND expires>? ORDER BY created_at DESC,id DESC LIMIT 1",(args.email.lower(),time.time())).fetchone()
        if not row:parser.exit(1,'No current local capture is available.\n')
        path=local_path(root/'.local-capture'/(row[0]+'.json'));capture=json.loads(path.read_text())
        if digest(capture['code'])!=row[1]:parser.exit(1,'No current local capture is available.\n')
        print(path)
    except (OSError,ValueError,KeyError):parser.exit(1,'No current local capture is available.\n')


if __name__=='__main__':main()