package main

import (
    "context"
    "fmt"
    "log"

    "github.com/bpowers/boxedpy"
    "github.com/bpowers/boxedpy/sandbox"
)

func main() {
    // Create Python instance from virtualenv
    py, err := boxedpy.New(boxedpy.Config{
        VirtualEnv: "/path/to/venv",
    })
    if err != nil {
        log.Fatal(err)
    }
    defer py.Close()

    // Create sandbox policy
    policy := sandbox.DefaultPolicy()
    policy.WorkDir = "/path/to/workdir"

    // Execute Python code
    ctx := context.Background()
    cmd, err := py.Command(ctx, policy, boxedpy.ExecConfig{},
        "-c", "print('Hello from sandbox')")
    if err != nil {
        log.Fatal(err)
    }

    output, err := cmd.CombinedOutput()
    if err != nil {
        log.Fatal(err)
    }

    fmt.Println(string(output))
}

// Create Python instance with read-only data access
py, err := boxedpy.New(boxedpy.Config{
    VirtualEnv:   "/path/to/venv",
    ReferenceDir: "/path/to/datasets",  // Mounted read-only
})
if err != nil {
    log.Fatal(err)
}
defer py.Close()

policy := sandbox.DefaultPolicy()
policy.WorkDir = "/path/to/workdir"  // Automatically mounted read-write

// Run script with access to datasets and workdir
cmd, err := py.Command(ctx, policy, boxedpy.ExecConfig{},
    "/path/to/workdir/analyze.py")

py, err := boxedpy.New(boxedpy.Config{
    VirtualEnv: "/path/to/venv",
})
if err != nil {
    log.Fatal(err)
}
defer py.Close()

policy := sandbox.DefaultPolicy()
policy.WorkDir = "/path/to/notebooks"
policy.AllowLocalhostOnly = true  // Required for Jupyter kernel communication

cmd, err := py.Command(ctx, policy, boxedpy.ExecConfig{},
    "-m", "jupyter", "nbconvert", "--execute", "notebook.ipynb")
if err != nil {
    log.Fatal(err)
}

// Configure Jupyter environment
jupyterEnv := boxedpy.JupyterEnv(policy.WorkDir, py.ConfigDir())
cmd.Env = append(os.Environ(), jupyterEnv...)

output, err := cmd.CombinedOutput()

output, err := cmd.CombinedOutput()
if err != nil {
    // Parse Python errors for helpful debugging hints
    if pyErr := boxedpy.ParsePythonError(output); pyErr != nil {
        fmt.Printf("Python %s at line %d: %s\n",
            pyErr.Type, pyErr.Line, pyErr.Message)
        fmt.Printf("Hint: %s\n", pyErr.Hint)
    }
    return err
}

policy := sandbox.DefaultPolicy()
policy.WorkDir = "/workdir"

// Add read-only data mount
policy.ReadOnlyMounts = append(policy.ReadOnlyMounts,
    sandbox.Mount{Source: "/data", Target: "/data"},
)

// Add read-write output mount
policy.ReadWriteMounts = append(policy.ReadWriteMounts,
    sandbox.Mount{Source: "/output", Target: "/output"},
)

policy := sandbox.DefaultPolicy()

// Option 1: Block all network (default)
policy.AllowNetwork = false
policy.AllowLocalhostOnly = false

// Option 2: Allow localhost only (recommended for Jupyter)
policy.AllowLocalhostOnly = true

// Option 3: Allow full network access (use with caution)
policy.AllowNetwork = true

// Create policy once
pythonPolicy := sandbox.DefaultPolicy()
pythonPolicy.ReadOnlyMounts = append(pythonPolicy.ReadOnlyMounts,
    sandbox.Mount{Source: "/opt", Target: "/opt"},
)

// Reuse across concurrent HTTP requests
http.HandleFunc("/execute", func(w http.ResponseWriter, r *http.Request) {
    cmd, err := pythonPolicy.Command(r.Context(), "python3", "-c", code)
    // ... execute command
})

// Specify config directory for Python library state
py, err := boxedpy.New(boxedpy.Config{
    VirtualEnv: "/path/to/venv",
    ConfigDir:  "/persistent/config",  // For matplotlib, jupyter, etc.
})