#!/usr/bin/env python3
"""AAE Lab 03: narrow, read-only tools with validation."""
from __future__ import annotations
import os
import platform
import shutil
import socket

ALLOWED_SERVICES = {"nginx", "ssh", "docker"}

def get_hostname():
    return {"hostname": socket.gethostname()}

def get_disk_usage():
    total, used, free = shutil.disk_usage("/")
    pct = round((used / total) * 100, 1)
    return {"mount": "/", "percent_used": pct}

def get_service_status(service: str):
    if service not in ALLOWED_SERVICES:
        raise ValueError(f"service not allowed: {service}")
    # Beginner-safe fixture: no shell command is executed.
    return {"service": service, "status": "unknown", "note": "Beginner lab uses a safe fixture; integrate OS-specific read-only status later."}

TOOLS = {
    "get_hostname": lambda args: get_hostname(),
    "get_disk_usage": lambda args: get_disk_usage(),
    "get_service_status": lambda args: get_service_status(args["service"]),
}

def execute_tool(name: str, args: dict):
    if name not in TOOLS:
        raise ValueError(f"tool not allowed: {name}")
    if not isinstance(args, dict):
        raise TypeError("tool arguments must be an object")
    if name == "get_service_status":
        service = args.get("service")
        if not isinstance(service, str) or not service:
            raise ValueError("service must be a non-empty string")
    return TOOLS[name](args)

print("AAE Lab 03 — safe tools\n")
for request in [
    ("get_hostname", {}),
    ("get_disk_usage", {}),
    ("get_service_status", {"service": "nginx"}),
]:
    print(request, "→", execute_tool(*request))

print("\nNow prove the policy rejects an unsupported service:")
try:
    execute_tool("get_service_status", {"service": "definitely-not-allowed"})
except ValueError as exc:
    print("✓ Rejected:", exc)
else:
    raise SystemExit("FAIL: unsupported service was not rejected")