#!/usr/bin/env python3
"""digestread.py — READ-ONLY (login + GET only): per deployed app, the catalog's tested digest (catalog_digests,
catalog_tested_at) vs app.yaml installed_images (ref, digest, at), and the badge order the box computes.
GUEST=9201 BASE=https://<ip> for demo-hp's standing guest. Part C (the same-name security fix)."""
import json, os, sys
import walk as w
w.login()
c, d = w.ctl("GET", "/api/stacks")
data = d.get("data") if isinstance(d, dict) else d
stacks = data if isinstance(data, list) else (data or {}).get("stacks", [])
print(f"# guest {w.GUEST} {w.BASE} — read-only")
for s in sorted(stacks, key=lambda x: x.get("name", "")):
    if not s.get("deployed"):
        continue
    st = w.stack(s["name"])
    ac = st.get("app_config") or {}
    cd = st.get("catalog_digests") or {}
    print(f"{s['name']} | update_order={st.get('update_order')!r} badge={st.get('update_badge') or st.get('badge')!r} catalog_tested_at={st.get('catalog_tested_at')}")
    for svc, rec in sorted((ac.get("installed_images") or {}).items()):
        ref = rec.get("ref") if isinstance(rec, dict) else rec
        dg = (rec.get("digest") if isinstance(rec, dict) else "") or ""
        at = rec.get("at") if isinstance(rec, dict) else ""
        cat = cd.get(svc, "")
        print(f"    {svc}: {ref} installed={dg[7:19] or '-'} at={at} catalog={cat[7:19] or '-'} equal={bool(cat) and cat == dg}")