"""Deterministic, credential-free Hub seed data."""

from __future__ import annotations

from dataclasses import dataclass
from uuid import NAMESPACE_URL, UUID, uuid5

from sqlalchemy import select
from sqlalchemy.orm import Session

from .models import RiskClassRow, WorkspaceRow

SEED_NAMESPACE = "https://hub.example.com/seed/v1"


@dataclass(frozen=True)
class SeedResult:
    workspace_id: UUID
    risk_class_codes: tuple[str, ...]


def _stable_id(kind: str, name: str) -> UUID:
    return uuid5(NAMESPACE_URL, f"{SEED_NAMESPACE}:{kind}:{name}")


def seed_database(session: Session) -> SeedResult:
    """Insert the ITWorx workspace and safe read-only risk classes idempotently."""

    workspace_id = _stable_id("workspace", "itworx")
    workspace = session.get(WorkspaceRow, workspace_id)
    if workspace is None:
        workspace = WorkspaceRow(id=workspace_id, slug="itworx", name="ITWorx", status="active")
        session.add(workspace)

    risk_classes = (
        ("health-read", "Read-only health and liveness metadata", 65536),
        ("metadata-read", "Read-only catalog and metadata inspection", 65536),
        ("read-only", "Read-only target-system capability", 131072),
    )
    for code, description, max_output_bytes in risk_classes:
        existing = session.get(RiskClassRow, code)
        if existing is None:
            session.add(
                RiskClassRow(
                    code=code,
                    description=description,
                    allows_writes=False,
                    max_output_bytes=max_output_bytes,
                )
            )

    session.flush()
    persisted = session.scalar(select(WorkspaceRow.id).where(WorkspaceRow.slug == "itworx"))
    if persisted is None:
        raise RuntimeError("deterministic workspace seed was not persisted")
    return SeedResult(
        workspace_id=persisted, risk_class_codes=tuple(code for code, _, _ in risk_classes)
    )