pb

#!/usr/bin/env python3
"""pb: command-line client for pastebin-worker."""

from __future__ import annotations

import argparse
import base64
import json
import logging
import math
import os
import re
import shutil
import subprocess
import sys
import time
from pathlib import Path
from typing import Callable, Optional
from urllib.parse import unquote, urlsplit, urlunsplit

import requests

DEFAULT_DOMAIN = "https://shz.al"
SCRIPT_NAME = "pb"
MPU_THRESHOLD = 5 * 1024 * 1024  # switch to multipart upload above this size
MPU_CHUNK_SIZE = 5 * 1024 * 1024  # R2 requires every part except the last to be >=5 MiB
ENCRYPTION_SCHEME = "AES-GCM"
ENCRYPTION_HEADER = "X-PB-Encryption-Scheme"

LEVEL_COLORS = {
    logging.DEBUG: "90",
    logging.INFO: "0",
    logging.WARNING: "33",
    logging.ERROR: "31",
    logging.CRITICAL: "31",
}


class ColorFormatter(logging.Formatter):
    def __init__(self, use_color: bool) -> None:
        super().__init__(fmt="%(name)s: %(message)s")
        self.use_color = use_color

    def format(self, record: logging.LogRecord) -> str:
        msg = super().format(record)
        if not self.use_color:
            return msg
        code = LEVEL_COLORS.get(record.levelno, "0")
        return f"\x1b[0;{code}m{msg}\x1b[0m"


logger = logging.getLogger(SCRIPT_NAME)


def _format_size(n: int) -> str:
    if n >= 1024 * 1024:
        return f"{n / 1024 / 1024:.1f} MiB"
    if n >= 1024:
        return f"{n / 1024:.1f} KiB"
    return f"{n} B"


class ProgressBar:
    """Single-line progress bar rendered to stderr; no-op when stderr isn't a TTY."""

    def __init__(self, total: int, label: str = "upload") -> None:
        self.total = total
        self.done = 0
        self.label = label
        # Suppress the bar when verbose logging is on: its per-part debug lines
        # already trace progress and the \r-redraw would otherwise interleave.
        self.tty = sys.stderr.isatty() and not logger.isEnabledFor(logging.DEBUG)
        self.last_render = 0.0
        self.width = 30

    def update(self, delta: int) -> None:
        self.done = min(self.done + delta, self.total)
        self._render(force=self.done >= self.total)

    def _render(self, force: bool = False) -> None:
        if not self.tty:
            return
        now = time.monotonic()
        if not force and now - self.last_render < 0.1:
            return
        self.last_render = now
        frac = self.done / self.total if self.total > 0 else 1.0
        filled = int(self.width * frac)
        if filled >= self.width:
            bar = "=" * self.width
        else:
            bar = "=" * filled + ">" + " " * (self.width - filled - 1)
        msg = (
            f"\r{self.label} [{bar}] {_format_size(self.done)} / "
            f"{_format_size(self.total)} ({frac * 100:.0f}%)"
        )
        sys.stderr.write(msg)
        sys.stderr.flush()

    def close(self) -> None:
        if self.tty:
            sys.stderr.write("\n")
            sys.stderr.flush()


class ProgressReader:
    """File-like wrapper over a bytes buffer; calls on_read(n) as bytes are consumed.

    requests streams from `data=<file-like>` by calling .read(size) repeatedly,
    so we get fine-grained progress within a single PUT/POST.
    """

    def __init__(self, buf: bytes, on_read: Callable[[int], None]) -> None:
        self.buf = buf
        self.pos = 0
        self.on_read = on_read

    def __len__(self) -> int:
        return len(self.buf)

    def read(self, size: int = -1) -> bytes:
        if size is None or size < 0:
            size = len(self.buf) - self.pos
        chunk = self.buf[self.pos : self.pos + size]
        self.pos += len(chunk)
        if chunk:
            self.on_read(len(chunk))
        return chunk


def _import_aesgcm():
    # Lazy import so that users who never touch encryption don't need the
    # optional 'cryptography' dependency installed.
    try:
        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
    except ImportError:
        die(
            "encryption requires the 'cryptography' package; "
            "install it with `pip install cryptography`"
        )
        raise  # unreachable; appeases type-checker
    return AESGCM


def b64_variant_encode(data: bytes) -> str:
    # Same variant as the frontend: '/' -> '_', strip trailing '='. '+' is kept.
    return base64.b64encode(data).decode("ascii").replace("/", "_").rstrip("=")


def b64_variant_decode(s: str) -> bytes:
    s = s.replace("_", "/")
    pad = (-len(s)) % 4
    return base64.b64decode(s + "=" * pad)


def encrypt_body(body: bytes) -> tuple[str, bytes]:
    AESGCM = _import_aesgcm()
    raw_key = os.urandom(32)
    iv = os.urandom(12)
    ciphertext = AESGCM(raw_key).encrypt(iv, body, None)
    return b64_variant_encode(raw_key), iv + ciphertext


def decrypt_body(scheme: str, encoded_key: str, blob: bytes) -> bytes:
    if scheme != ENCRYPTION_SCHEME:
        die(f"unsupported encryption scheme: {scheme}")
    AESGCM = _import_aesgcm()
    try:
        raw_key = b64_variant_decode(encoded_key)
    except (ValueError, base64.binascii.Error) as e:
        die(f"invalid decryption key: {e}")
        raise
    if len(raw_key) not in (16, 24, 32):
        die(
            f"AES-GCM key must decode to 16/24/32 bytes, got {len(raw_key)}; "
            "make sure the full URL fragment was passed"
        )
    if len(blob) < 12 + 16:
        die("ciphertext too short to contain IV + GCM tag")
    iv, ct = blob[:12], blob[12:]
    from cryptography.exceptions import InvalidTag

    try:
        return AESGCM(raw_key).decrypt(iv, ct, None)
    except InvalidTag:
        die("decryption failed: wrong key or corrupted ciphertext")
        raise


def make_decryption_url(paste_url: str, encoded_key: str) -> str:
    parts = urlsplit(paste_url)
    return urlunsplit((parts.scheme, parts.netloc, "/d" + parts.path, "", encoded_key))


def bare_paste_name(name: str) -> str:
    # /get accepts NAME[.EXT]; the history is keyed on the bare name.
    return name.split(".", 1)[0]


def _confirm_overwrite(path: Path) -> bool:
    # Non-interactive callers must opt in explicitly via -f/--force; we refuse
    # rather than silently overwriting or silently skipping so scripts get a
    # clear signal.
    if not sys.stdin.isatty():
        die(
            f"refusing to overwrite '{path}' in non-interactive mode; "
            "pass -f/--force to overwrite"
        )
    try:
        ans = input(f"file '{path}' exists, overwrite? [y/N] ").strip().lower()
    except EOFError:
        return False
    return ans in ("y", "yes")


def parse_content_disposition_filename(header: Optional[str]) -> Optional[str]:
    # Worker always emits the RFC-5987 form: `filename*=UTF-8''<urlencoded>`.
    # Accept the legacy `filename="..."` too, in case that ever changes.
    if not header:
        return None
    m = re.search(r"filename\*=([^']*)'([^']*)'([^;]+)", header)
    if m:
        charset, _lang, value = m.groups()
        try:
            return unquote(value, encoding=charset or "utf-8")
        except (LookupError, UnicodeDecodeError):
            return unquote(value)
    m = re.search(r'filename="([^"]+)"', header) or re.search(r"filename=([^;\s]+)", header)
    return m.group(1) if m else None


def setup_logger(verbose: bool) -> None:
    handler = logging.StreamHandler(sys.stderr)
    handler.setFormatter(ColorFormatter(use_color=sys.stderr.isatty()))
    logger.handlers.clear()
    logger.addHandler(handler)
    logger.setLevel(logging.DEBUG if verbose else logging.INFO)


def die(msg: str) -> "Optional[None]":
    logger.error(msg)
    sys.exit(1)


def history_path() -> Path:
    base = os.environ.get("XDG_CONFIG_DIR") or os.path.expanduser("~/.config")
    return Path(base) / "pb_hist"


def ensure_history() -> Path:
    p = history_path()
    try:
        p.parent.mkdir(parents=True, exist_ok=True)
        p.touch(exist_ok=True)
    except OSError as e:
        die(f"cannot create history file '{p}': {e}")
    return p


def append_history(entry: str, key: Optional[str] = None) -> None:
    # entry is the manage-URL basename "NAME:PASSWD"; an optional decryption
    # key is appended as "...#KEY" so the existing awk-based fish completion
    # (split on ':') still sees NAME in $1.
    p = ensure_history()
    line = entry if key is None else f"{entry}#{key}"
    with p.open("a") as f:
        f.write(line + "\n")


# PASSWD only forbids newlines, so it may legitimately contain '#'. KEYs are
# b64-variant-encoded raw AES keys, so they are always [A-Za-z0-9+_]{22,32,43}
# (no padding, for 128/192/256-bit). We rely on that exact shape to split a
# 'PASSWD' / 'PASSWD#KEY' value without ambiguity.
_KEY_SUFFIX_RE = re.compile(r"#([A-Za-z0-9+_]+)$")


def _split_passwd_and_key(value: str) -> tuple[str, Optional[str]]:
    m = _KEY_SUFFIX_RE.search(value)
    if m and len(m.group(1)) in (22, 32, 43):
        return value[: m.start()], m.group(1)
    return value, None


def lookup_passwd(name: str) -> Optional[str]:
    p = ensure_history()
    found: Optional[str] = None
    with p.open() as f:
        for line in f:
            line = line.rstrip("\n")
            if line.startswith(f"{name}:"):
                value = line.split(":", 1)[1]
                passwd, _ = _split_passwd_and_key(value)
                found = passwd
    return found


def lookup_key(name: str) -> Optional[str]:
    p = ensure_history()
    found: Optional[str] = None
    with p.open() as f:
        for line in f:
            line = line.rstrip("\n")
            if line.startswith(f"{name}:"):
                value = line.split(":", 1)[1]
                _, key = _split_passwd_and_key(value)
                if key is not None:
                    found = key
    return found


def clip(text: str) -> None:
    candidates = [
        ("pbcopy", []),
        ("xclip", ["-selection", "clipboard"]),
        ("xsel", ["-b"]),
        ("wl-copy", []),
    ]
    for cmd, args in candidates:
        if shutil.which(cmd):
            try:
                subprocess.run([cmd, *args], input=text.encode(), check=True)
                logger.info(f"'{text}' is copied to your clipboard")
            except subprocess.CalledProcessError as e:
                logger.warning(f"clipboard command '{cmd}' failed: {e}")
            return
    logger.warning(
        "Cannot find a clipboard tool. Requires one of "
        "'pbcopy' (macOS), 'xclip' (xorg), 'xsel' (xorg) or 'wl-copy' (wayland)."
    )


def read_content(file: Optional[str], content: Optional[str]) -> bytes:
    if content is not None and file is not None:
        die("cannot set both 'content' and 'file'")
    if file is not None:
        try:
            return Path(file).read_bytes()
        except OSError as e:
            die(f"cannot read file '{file}': {e}")
    if content is not None:
        return content.encode()
    return sys.stdin.buffer.read()


def log_request(method: str, url: str, fields: dict, params: dict) -> None:
    masked = {k: ("***" if k == "s" else v) for k, v in fields.items()}
    logger.debug(f"{method} {url}  fields={masked}  params={params}")


def manage_basename(manage_url: str) -> str:
    return manage_url.rstrip("/").rsplit("/", 1)[-1]


def _print_json(payload: dict) -> None:
    """Pretty-print JSON. If `jq` is on PATH, hand off to it for syntax coloring
    (matching what the old Bash script did); otherwise use stdlib indentation.
    `jq -C` forces color even when its stdout is not a TTY, so we gate on the
    real TTY here."""
    raw = json.dumps(payload, ensure_ascii=False)
    if shutil.which("jq"):
        color_flag = "-C" if sys.stdout.isatty() else "-M"
        try:
            subprocess.run(["jq", color_flag, "."], input=raw.encode(), check=True)
            return
        except (subprocess.CalledProcessError, OSError) as e:
            logger.debug(f"jq failed, falling back to plain JSON: {e}")
    print(json.dumps(payload, indent=2, ensure_ascii=False))


def _finalize_response(
    payload: dict,
    clip_flag: bool,
    encryption_key: Optional[str] = None,
) -> None:
    page_url = payload.get("url")
    display_url: Optional[str] = None
    if encryption_key and page_url:
        display_url = make_decryption_url(page_url, encryption_key)
        # The server response does not include the key (client-side only),
        # so surface it in the printed JSON for easy scripting.
        payload["decryptionUrl"] = display_url
    _print_json(payload)
    manage_url = payload.get("manageUrl")
    if manage_url:
        append_history(manage_basename(manage_url), key=encryption_key)
    if clip_flag:
        target = display_url or page_url
        if target:
            clip(target)


def upload_mpu(
    domain: str,
    body: bytes,
    fields: dict,
    is_update: bool,
    name: Optional[str],
    passwd: Optional[str],
    is_private: bool,
    expire: Optional[str],
    dry: bool,
    clip_flag: bool,
    encryption_key: Optional[str] = None,
    filename: Optional[str] = None,
) -> None:
    """Multipart upload for files larger than MPU_THRESHOLD.

    For post:   POST /mpu/create?n=&p=&e=
    For update: POST /mpu/create-update?name=&password=&e=
    Then PUT /mpu/resume?key=&uploadId=&partNumber= for each 5 MiB chunk.
    Finally POST /mpu/complete?name=&key=&uploadId= with `c=<json parts list>`.
    """
    total = len(body)
    num_parts = max(1, math.ceil(total / MPU_CHUNK_SIZE))

    if is_update:
        create_url = f"{domain}/mpu/create-update"
        create_params: dict = {"name": name, "password": passwd}
    else:
        create_url = f"{domain}/mpu/create"
        create_params = {}
        if name:
            create_params["n"] = name.lstrip("~")
        if is_private:
            create_params["p"] = "1"
    if expire:
        create_params["e"] = expire

    masked_create_params = dict(create_params)
    if "password" in masked_create_params:
        masked_create_params["password"] = "***"
    log_request("POST", create_url, {}, masked_create_params)
    logger.info(
        f"using MPU: {_format_size(total)} in {num_parts} part(s) of "
        f"{_format_size(MPU_CHUNK_SIZE)}"
    )
    if dry:
        for i in range(num_parts):
            chunk_size = min(MPU_CHUNK_SIZE, total - i * MPU_CHUNK_SIZE)
            log_request(
                "PUT",
                f"{domain}/mpu/resume",
                {},
                {"partNumber": i + 1, "size": chunk_size},
            )
        log_request("POST", f"{domain}/mpu/complete", {**fields, "c": "<parts...>"}, {})
        return

    try:
        create_resp = requests.post(create_url, params=create_params)
    except requests.RequestException as e:
        die(f"MPU create failed: {e}")
        return
    if not create_resp.ok:
        die(f"MPU create {create_resp.status_code}: {create_resp.text}")
    create = create_resp.json()
    key = create["key"]
    upload_id = create["uploadId"]
    paste_name = create["name"]

    bar = ProgressBar(total, label="MPU")
    uploaded_parts: list = []
    completed = False
    try:
        for i in range(num_parts):
            chunk = body[i * MPU_CHUNK_SIZE : (i + 1) * MPU_CHUNK_SIZE]
            logger.debug(f"PUT part {i + 1}/{num_parts}  size={len(chunk)}")
            reader = ProgressReader(chunk, bar.update)
            try:
                part_resp = requests.put(
                    f"{domain}/mpu/resume",
                    params={
                        "key": key,
                        "uploadId": upload_id,
                        "partNumber": i + 1,
                    },
                    data=reader,
                    headers={"Content-Length": str(len(chunk))},
                )
            except requests.RequestException as e:
                die(f"MPU part {i + 1} failed: {e}")
                return
            if not part_resp.ok:
                die(f"MPU part {i + 1} {part_resp.status_code}: {part_resp.text}")
            uploaded_parts.append(part_resp.json())

        complete_params = {"name": paste_name, "key": key, "uploadId": upload_id}
        complete_data = dict(fields)
        log_request(
            "POST" if not is_update else "PUT",
            f"{domain}/mpu/complete",
            {**complete_data, "c": "<parts...>"},
            complete_params,
        )
        try:
            complete_resp = requests.request(
                "POST" if not is_update else "PUT",
                f"{domain}/mpu/complete",
                params=complete_params,
                data=complete_data,
                files={"c": (filename, json.dumps(uploaded_parts).encode())},
            )
        except requests.RequestException as e:
            die(f"MPU complete failed: {e}")
            return
        if not complete_resp.ok:
            die(f"MPU complete {complete_resp.status_code}: {complete_resp.text}")

        try:
            payload = complete_resp.json()
        except ValueError:
            die(f"non-JSON response from /mpu/complete: {complete_resp.text}")
            return
        completed = True
    finally:
        bar.close()
        # Release R2-side multipart state if we didn't reach complete (chunk failed,
        # complete failed, Ctrl-C, etc.). Knowing key+uploadId is the auth.
        if not completed:
            try:
                requests.post(
                    f"{domain}/mpu/abort",
                    params={"key": key, "uploadId": upload_id},
                    timeout=5,
                )
                logger.info("MPU aborted on server")
            except requests.RequestException as abort_err:
                logger.warning(f"MPU abort failed; orphaned parts may remain: {abort_err}")

    _finalize_response(payload, clip_flag, encryption_key=encryption_key)


def post_or_put(
    method: str,
    url: str,
    fields: dict,
    body: Optional[bytes],
    verbose: bool,
    dry: bool,
    clip_flag: bool,
    log_url: Optional[str] = None,
    encryption_key: Optional[str] = None,
    filename: Optional[str] = None,
) -> None:
    files: dict = {}
    data: dict = {}
    for k, v in fields.items():
        data[k] = v
    if body is not None:
        # When no filename is provided, pass None so requests omits the
        # `filename=` parameter entirely; the worker then stores no filename
        # and clients can fall back to the paste name on download.
        files["c"] = (filename, body)

    log_request(
        method,
        log_url or url,
        {**fields, "c": "<...>" if body is not None else None},
        {},
    )
    if dry:
        return

    try:
        resp = requests.request(method, url, data=data, files=files or None)
    except requests.RequestException as e:
        die(f"request failed: {e}")
        return  # for type-checker; die() exits

    if resp.status_code not in (200, 302):
        die(f"{resp.status_code}: {resp.text}")

    try:
        payload = resp.json()
    except ValueError:
        die(f"non-JSON response: {resp.text}")
        return

    _finalize_response(payload, clip_flag, encryption_key=encryption_key)


def parse_name_passwd(arg: str) -> tuple[str, Optional[str]]:
    if ":" in arg:
        name, passwd = arg.split(":", 1)
        return name, passwd
    return arg, None


def cmd_post(args: argparse.Namespace, domain: str) -> None:
    if args.private and args.name:
        die("cannot set both 'private' and 'name'")
    if args.file and args.file_pos:
        die("cannot specify FILE both as positional argument and via '-f'")

    file = args.file or args.file_pos
    body = read_content(file, args.content)
    filename = args.filename or (Path(file).name if file else None)

    encryption_key: Optional[str] = None
    if args.encrypt:
        encryption_key, body = encrypt_body(body)

    if len(body) > MPU_THRESHOLD:
        mpu_fields: dict = {}
        if args.expire:
            mpu_fields["e"] = args.expire
        if args.passwd:
            mpu_fields["s"] = args.passwd
        if args.encrypt:
            mpu_fields["encryption-scheme"] = ENCRYPTION_SCHEME
        upload_mpu(
            domain,
            body,
            mpu_fields,
            is_update=False,
            name=args.name,
            passwd=None,
            is_private=bool(args.private),
            expire=args.expire,
            dry=args.dry,
            clip_flag=args.clip,
            encryption_key=encryption_key,
            filename=filename,
        )
        return

    fields: dict = {}
    if args.expire:
        fields["e"] = args.expire
    if args.name:
        fields["n"] = args.name
    if args.passwd:
        fields["s"] = args.passwd
    if args.private:
        fields["p"] = "true"
    if args.encrypt:
        fields["encryption-scheme"] = ENCRYPTION_SCHEME

    post_or_put(
        "POST",
        f"{domain}/",
        fields,
        body,
        args.verbose,
        args.dry,
        args.clip,
        encryption_key=encryption_key,
        filename=filename,
    )


def cmd_update(args: argparse.Namespace, domain: str) -> None:
    name, passwd = parse_name_passwd(args.target)
    if passwd is None:
        passwd = args.passwd or lookup_passwd(name)
    if not passwd:
        die(
            f"no passwd given, and cannot find passwd in history file '{history_path()}'"
        )

    body = read_content(args.file, args.content)
    filename = args.filename or (Path(args.file).name if args.file else None)

    encryption_key: Optional[str] = None
    if args.encrypt:
        encryption_key, body = encrypt_body(body)

    if len(body) > MPU_THRESHOLD:
        mpu_fields: dict = {}
        if args.expire:
            mpu_fields["e"] = args.expire
        if args.passwd:
            mpu_fields["s"] = args.passwd
        if args.encrypt:
            mpu_fields["encryption-scheme"] = ENCRYPTION_SCHEME
        upload_mpu(
            domain,
            body,
            mpu_fields,
            is_update=True,
            name=name,
            passwd=passwd,
            is_private=False,
            expire=args.expire,
            dry=args.dry,
            clip_flag=args.clip,
            encryption_key=encryption_key,
            filename=filename,
        )
        return

    fields: dict = {}
    if args.expire:
        fields["e"] = args.expire
    if args.passwd:
        fields["s"] = args.passwd
    if args.encrypt:
        fields["encryption-scheme"] = ENCRYPTION_SCHEME

    post_or_put(
        "PUT",
        f"{domain}/{name}:{passwd}",
        fields,
        body,
        args.verbose,
        args.dry,
        args.clip,
        log_url=f"{domain}/{name}:***",
        encryption_key=encryption_key,
        filename=filename,
    )


def cmd_get(args: argparse.Namespace, domain: str) -> None:
    if args.meta:
        if args.url:
            die("cannot combine --meta with --url")
        prefix = "m"
    elif args.url:
        prefix = "u"
    else:
        prefix = None
    if args.save is not None and args.output:
        die("cannot combine --save with -o/--output")
    base = f"{domain}/{prefix}/{args.name}" if prefix else f"{domain}/{args.name}"

    log_request("GET", base, {}, {})
    if args.dry:
        return

    try:
        resp = requests.get(base, allow_redirects=False)
    except requests.RequestException as e:
        die(f"request failed: {e}")
        return

    if resp.status_code not in (200, 302):
        die(f"{resp.status_code}: {resp.text}")

    if args.meta:
        try:
            payload = resp.json()
        except ValueError:
            die(f"non-JSON response from /m/: {resp.text}")
            return
        _print_json(payload)
        return

    content = resp.content
    scheme = resp.headers.get(ENCRYPTION_HEADER)
    decrypted = False
    if scheme and not args.no_decrypt:
        key = args.key or lookup_key(bare_paste_name(args.name))
        if not key:
            die(
                f"paste '{args.name}' is encrypted ({scheme}); pass --key KEY "
                f"or use --no-decrypt to keep the raw ciphertext"
            )
        content = decrypt_body(scheme, key, content)
        decrypted = True
    elif args.key and not scheme:
        logger.warning("--key given but paste is not encrypted; ignoring")

    if args.save is not None:
        server_name = parse_content_disposition_filename(resp.headers.get("Content-Disposition"))
        # Server tags encrypted downloads with a trailing `.encrypted`; strip
        # it once we've actually decrypted so the saved file gets its real name.
        if decrypted and server_name and server_name.endswith(".encrypted"):
            server_name = server_name[: -len(".encrypted")]
        # Defend against absolute paths / traversal in the server-supplied name.
        if server_name:
            server_name = Path(server_name).name
        filename = server_name or bare_paste_name(args.name)
        base_dir = Path(args.save)
        try:
            base_dir.mkdir(parents=True, exist_ok=True)
        except OSError as e:
            die(f"cannot create save dir '{base_dir}': {e}")
        out_path = base_dir / filename
        if out_path.exists() and not args.force:
            if not _confirm_overwrite(out_path):
                logger.info("aborted; file not overwritten")
                return
        out_path.write_bytes(content)
        logger.info(f"saved to '{out_path}'")
        return

    if args.output:
        Path(args.output).write_bytes(content)
    else:
        # Mirror curl's behaviour: refuse to splat binary at a terminal,
        # because escape sequences in the content can wedge the user's tty.
        # A NUL byte is the simplest reliable binary signal and matches what
        # file(1) and most tools use.
        if sys.stdout.isatty() and b"\x00" in content and not args.force:
            die(
                "refusing to write binary output to a terminal. "
                "Use -o FILE to save, --save [DIR] to use the server filename, "
                "pipe the output, or pass -f/--force to write anyway"
            )
        sys.stdout.buffer.write(content)


def cmd_delete(args: argparse.Namespace, domain: str) -> None:
    name, passwd = parse_name_passwd(args.target)
    if passwd is None:
        passwd = lookup_passwd(name)
    if not passwd:
        die(
            f"no passwd given, and cannot find passwd in history file '{history_path()}'"
        )

    url = f"{domain}/{name}:{passwd}"
    log_request("DELETE", f"{domain}/{name}:***", {}, {})
    if args.dry:
        return

    try:
        resp = requests.delete(url)
    except requests.RequestException as e:
        die(f"request failed: {e}")
        return

    if resp.status_code != 200:
        die(f"{resp.status_code}: {resp.text}")


def build_common_parser() -> argparse.ArgumentParser:
    """Parent parser holding flags that may appear before OR after the action.

    Using default=argparse.SUPPRESS means subparser parsing does NOT clobber
    values already set by the main parser when the same flag appears before
    the action.
    """
    common = argparse.ArgumentParser(add_help=False)
    common.add_argument(
        "-v",
        "--verbose",
        action="store_true",
        default=argparse.SUPPRESS,
        help="verbose output",
    )
    common.add_argument(
        "-d",
        "--dry",
        action="store_true",
        default=argparse.SUPPRESS,
        help="dry run, do not send the request",
    )
    common.add_argument(
        "--base-url",
        dest="base_url",
        metavar="URL",
        default=argparse.SUPPRESS,
        help=f"base URL of the pastebin instance (overrides $PB_DOMAIN, default: {DEFAULT_DOMAIN})",
    )
    return common


def build_parser() -> argparse.ArgumentParser:
    common = build_common_parser()
    parser = argparse.ArgumentParser(
        prog=SCRIPT_NAME,
        description="pastebin-worker command-line client",
        parents=[common],
    )
    sub = parser.add_subparsers(dest="action", required=True, metavar="ACTION")

    p_post = sub.add_parser(
        "post",
        aliases=["p"],
        help="upload a paste",
        description="Upload a paste. If neither FILE nor -c/--content is given, "
        "the paste content is read from stdin.",
        parents=[common],
    )
    p_post.add_argument("-c", "--content", help="inline content of the paste")
    p_post.add_argument("-e", "--expire", help="expiration time (e.g. 60, 1h, 7d)")
    p_post.add_argument("-n", "--name", help="custom name (prefix with ~)")
    p_post.add_argument("-s", "--passwd", help="password")
    p_post.add_argument(
        "-p", "--private", action="store_true", help="use longer random name"
    )
    p_post.add_argument(
        "-x", "--clip", action="store_true", help="copy URL to clipboard"
    )
    p_post.add_argument(
        "-E",
        "--encrypt",
        action="store_true",
        help="client-side encrypt with a fresh AES-GCM key (requires 'cryptography')",
    )
    p_post.add_argument(
        "-F",
        "--filename",
        help="override the filename stored with the paste "
        "(defaults to the basename of the source file, if any)",
    )
    p_post.add_argument("-f", "--file", help="read paste from file")
    p_post.add_argument(
        "file_pos", nargs="?", metavar="FILE", help="read paste from file (positional)"
    )
    p_post.set_defaults(func=cmd_post)

    p_update = sub.add_parser(
        "update",
        aliases=["u"],
        help="update an existing paste",
        description="Update an existing paste. If neither -f/--file nor -c/--content "
        "is given, the new content is read from stdin. If PASSWD is omitted, it is "
        "looked up from the history file.",
        parents=[common],
    )
    p_update.add_argument("target", help="NAME[:PASSWD]")
    p_update.add_argument("-c", "--content", help="inline content of the paste")
    p_update.add_argument("-e", "--expire", help="expiration time")
    p_update.add_argument("-s", "--passwd", help="password (overrides history lookup)")
    p_update.add_argument("-f", "--file", help="read paste from file")
    p_update.add_argument(
        "-x", "--clip", action="store_true", help="copy URL to clipboard"
    )
    p_update.add_argument(
        "-E",
        "--encrypt",
        action="store_true",
        help="client-side encrypt with a fresh AES-GCM key (requires 'cryptography')",
    )
    p_update.add_argument(
        "-F",
        "--filename",
        help="override the filename stored with the paste "
        "(defaults to the basename of the source file, if any)",
    )
    p_update.set_defaults(func=cmd_update)

    p_get = sub.add_parser(
        "get",
        aliases=["g"],
        help="fetch a paste",
        parents=[common],
    )
    p_get.add_argument("name", help="NAME[.EXT]")
    p_get.add_argument("-o", "--output", help="write to FILE instead of stdout")
    p_get.add_argument(
        "-u", "--url", action="store_true", help="hit /u/ for 302 URL redirect"
    )
    p_get.add_argument(
        "--meta", action="store_true", help="fetch /m/<name> metadata as pretty JSON"
    )
    p_get.add_argument(
        "-K",
        "--key",
        help="decryption key (overrides history lookup); only used if paste is encrypted",
    )
    p_get.add_argument(
        "--no-decrypt",
        action="store_true",
        help="do not decrypt encrypted pastes; write raw ciphertext",
    )
    p_get.add_argument(
        "--save",
        nargs="?",
        const=".",
        default=None,
        metavar="DIR",
        help="save under DIR using the server-provided filename "
        "(DIR defaults to current directory; falls back to the paste name "
        "if the server has no filename)",
    )
    p_get.add_argument(
        "-f",
        "--force",
        action="store_true",
        help="with --save, overwrite an existing file without prompting; "
        "without --save, allow binary content to be written to a terminal",
    )
    p_get.set_defaults(func=cmd_get)

    p_del = sub.add_parser(
        "delete",
        aliases=["d"],
        help="delete a paste",
        parents=[common],
    )
    p_del.add_argument("target", help="NAME[:PASSWD]")
    p_del.set_defaults(func=cmd_delete)

    return parser


def main(argv: Optional[list] = None) -> None:
    parser = build_parser()
    args = parser.parse_args(argv)
    # These flags use default=argparse.SUPPRESS so that placing them before
    # the action does not get clobbered by the subparser. Fill in fallbacks.
    args.verbose = getattr(args, "verbose", False)
    args.dry = getattr(args, "dry", False)
    base_url = getattr(args, "base_url", None)
    setup_logger(args.verbose)

    domain = (base_url or os.environ.get("PB_DOMAIN") or DEFAULT_DOMAIN).rstrip("/")
    args.func(args, domain)


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        # Ensure any in-flight progress bar leaves the cursor on a fresh line.
        if sys.stderr.isatty():
            sys.stderr.write("\n")
            sys.stderr.flush()
        if logger.handlers:
            logger.warning("interrupted")
        sys.exit(130)