#!/usr/bin/env python3
"""Add desk A records for biggrinrtx.com via WordPress.com API.

  email/grok/h7/share → 71.86.186.10
  Apex stays WP.com Atomic.

Uses magazine .wp-oauth.json · never prints token.
"""
from __future__ import annotations
import json, sys, urllib.parse, urllib.request, urllib.error
from pathlib import Path

OAUTH = Path.home() / "Desktop/biggrinrtx-magazine/.wp-oauth.json"
if not OAUTH.is_file():
    OAUTH = Path.home() / ".config/biggrinrtx/wp-oauth.json"
BASE = "https://public-api.wordpress.com/rest/v1.1"
DOMAIN = "biggrinrtx.com"
IP = "71.86.186.10"
NAMES = ["email", "grok", "h7", "share"]

def token() -> str:
    d = json.loads(OAUTH.read_text(encoding="utf-8"))
    return urllib.parse.unquote(d["access_token"])

def post(records_to_add):
    data = urllib.parse.urlencode({"dns": json.dumps({"records_to_add": records_to_add})}).encode()
    req = urllib.request.Request(
        f"{BASE}/domains/{DOMAIN}/dns",
        data=data,
        headers={
            "Authorization": f"Bearer {token()}",
            "User-Agent": "BigGrinRTX-wp-dns/1.0",
            "Accept": "application/json",
            "Content-Type": "application/x-www-form-urlencoded",
        },
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=45) as r:
        return json.loads(r.read().decode())

def main() -> int:
    recs = [{"type": "A", "name": n, "data": IP} for n in NAMES]
    try:
        out = post(recs)
    except urllib.error.HTTPError as e:
        print("HTTP", e.code, e.read().decode()[:300], file=sys.stderr)
        return 1
    for r in out.get("records") or []:
        if r.get("type") == "A" and r.get("name") in NAMES:
            print(f"OK {r.get('name')} A {r.get('data') or r.get('rdata')}")
    return 0

if __name__ == "__main__":
    raise SystemExit(main())