import http.client
import json
from urllib.parse import urlsplit


def compare_control_roles(base_url, control_token, agent_token):
    """Read an existing sidecar approval queue using independently configured roles.
    No approval is issued or resolved. Never print either bearer credential.
    """
    if not control_token or not agent_token or control_token == agent_token:
        raise ValueError("operator and agent credentials must be distinct")
    base = urlsplit(base_url)
    if base.scheme not in ("http", "https") or base.path not in ("", "/") or base.query or base.fragment:
        raise ValueError("supply the exact trusted sidecar origin")

    def queue(token):
        cls = http.client.HTTPSConnection if base.scheme == "https" else http.client.HTTPConnection
        conn = cls(base.hostname, base.port, timeout=20)
        try:
            conn.request("GET", "/approvals/pending", headers={
                "Authorization": "Bearer " + token, "Accept": "application/json"})
            response = conn.getresponse()
            return response.status, json.loads(response.read())
        finally:
            conn.close()

    allowed_status, queue_result = queue(control_token)
    assert allowed_status == 200, "configured control client could not read the queue"
    denied_status, refusal = queue(agent_token)
    assert denied_status == 403 and refusal["error"] == "chio_control_forbidden"
    return {"operator_status": allowed_status, "queue": queue_result,
            "agent_status": denied_status, "refusal": refusal}