#!/usr/bin/env python3
"""Resolve the Gac Mai render-service API key without printing or persisting it.

Import resolve_render_api_key() from a GPU-host submitter. The caller must use the
returned value only for the request header and must never include it in receipts.
"""
from pathlib import Path
import os

ENV_NAMES = (
    "GACMAI_RENDER_API_KEY",
    "GPU_RENDER_API_KEY",
    "RENDER_API_KEY",
    "OPENMONTAGE_RENDER_API_KEY",
)


def resolve_render_api_key() -> str | None:
    for name in ENV_NAMES:
        if os.environ.get(name):
            return os.environ[name]

    # Service-only secrets may be available only to the running GPU renderer.
    for cmdline in Path("/proc").glob("[0-9]*/cmdline"):
        try:
            command = cmdline.read_bytes().replace(b"\0", b" ").decode(errors="ignore")
            if "/opt/gacmai-gpu-render/app.py" not in command:
                continue
            entries = (cmdline.parent / "environ").read_bytes().split(b"\0")
            environment = {
                item.split(b"=", 1)[0].decode(): item.split(b"=", 1)[1].decode()
                for item in entries
                if b"=" in item
            }
            for name in ENV_NAMES:
                if environment.get(name):
                    return environment[name]
        except (OSError, ValueError):
            continue
    return None


if __name__ == "__main__":
    # Deliberately disclose availability only, never the credential.
    raise SystemExit(0 if resolve_render_api_key() else 1)