#!/usr/bin/env python3
"""Read-only exact-tenant database evidence; no credentials or arbitrary SQL."""
import json
from pathlib import Path
import sqlite3
import sys
from run import guard

run = Path(sys.argv[1]).resolve()
guard(run)
table, store = sys.argv[2:4]
if table not in ('shifts', 'time_punches', 'timesheets', 'payroll_exports'):
    raise RuntimeError('Non-evidence table refused')
manifest = json.loads((run / 'manifest.json').read_text())
if store not in {s['id'] for s in manifest['stores'].values()}:
    raise RuntimeError('Unknown fixture store')
with sqlite3.connect(f'file:{run / "database.sqlite"}?mode=ro', uri=True) as db:
    db.row_factory = sqlite3.Row
    rows = [dict(row) for row in db.execute(f'SELECT * FROM "{table}" WHERE store_id = ?', (store,))]
    if len(rows) > 100:
        raise RuntimeError('Evidence cardinality bound exceeded')
    print(json.dumps(rows))