"""WP-310 base-image remediation and live-tool contract regression tests."""

from __future__ import annotations

import json
from pathlib import Path
from uuid import UUID

from jsonschema import Draft202012Validator

from connectors.gitea import GiteaConnector
from connectors.unraid import FakeBrokerClient, RegisteredContainer, UnraidConnector
from packages.connector_kit import ConnectorContext, GiteaRepositoryRegistry, RegisteredRepository
from services.runtime.control_api import _project_connector_output

ROOT = Path(__file__).resolve().parents[1]
PROJECT_ID = UUID("11111111-1111-1111-1111-111111111111")


class _RepositoryMetadataClient:
    @staticmethod
    def repository(repository: RegisteredRepository) -> dict[str, object]:
        return {
            "name": repository.name,
            "owner": {"login": repository.owner},
            "private": repository.private,
            "default_branch": "main",
            "empty": False,
        }


def _context() -> ConnectorContext:
    return ConnectorContext(
        workspace_id=UUID("22222222-2222-2222-2222-222222222222"),
        project_id=PROJECT_ID,
        project_slug="ludarium",
        environment="prod",
    )


def _output_schema(name: str) -> dict:
    document = json.loads((ROOT / "catalog" / "tools" / name).read_text(encoding="utf-8"))
    return document["spec"]["outputSchema"]


def test_all_python_runtime_images_apply_the_exact_security_layer() -> None:
    installer = (ROOT / "infrastructure" / "images" / "install-base-security-updates.sh").read_text(
        encoding="utf-8"
    )
    assert "2.41.5-0+deb13u1" in installer
    assert "1:4.16.0-2+really2.41.5-0+deb13u1" in installer
    assert "apt-get upgrade" not in installer
    assert "apt-get dist-upgrade" not in installer
    for dockerfile in (
        ROOT / "infrastructure" / "images" / "python-service" / "Dockerfile",
        ROOT / "infrastructure" / "images" / "docker-read-broker" / "Dockerfile",
        ROOT / "infrastructure" / "images" / "observability" / "Dockerfile",
    ):
        content = dockerfile.read_text(encoding="utf-8")
        assert "COPY infrastructure/images/install-base-security-updates.sh" in content
        assert "RUN sh /tmp/install-base-security-updates.sh" in content


def test_base_security_layer_pins_and_verifies_staging_fixed_versions() -> None:
    installer = (ROOT / "infrastructure" / "images" / "install-base-security-updates.sh").read_text(
        encoding="utf-8"
    )
    fixed_packages = {
        "gzip": ("gzip", "1.13-1+deb13u1"),
        "libpcre2-8-0": ("pcre2", "10.46-1~deb13u3"),
        "libsqlite3-0": ("sqlite3", "3.46.1-7+deb13u2"),
        "libssl3t64": ("openssl", "3.5.7-1~deb13u3"),
        "openssl": ("openssl", "3.5.7-1~deb13u3"),
        "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u3"),
        "perl-base": ("perl_base", "5.40.1-6+deb13u1"),
    }
    for package, (variable, version) in fixed_packages.items():
        assert f"{variable}_version='{version}'" in installer
        assert f'"{package}=${{{variable}_version}}"' in installer
        assert f'assert_package_version "{package}" "${{{variable}_version}}"' in installer


def test_gitea_list_envelope_projects_to_the_registered_contract() -> None:
    registry = GiteaRepositoryRegistry(
        (
            RegisteredRepository(
                repository_ref="ludarium",
                project_id=PROJECT_ID,
                owner="jens",
                name="Ludarium",
                source_uri="itworx-git://ludarium/ludarium",
                private=True,
            ),
        )
    )
    connector = GiteaConnector(_RepositoryMetadataClient(), registry)  # type: ignore[arg-type]
    schema = _output_schema("gitea-repository-list.yaml")

    projected, warnings = _project_connector_output(connector.repository_list(_context()), schema)

    assert list(Draft202012Validator(schema).iter_errors(projected)) == []
    assert projected["items"][0]["defaultBranch"] == "main"
    assert "sourceUri" not in projected["items"][0]
    assert projected["generatedAt"]
    assert warnings == []


def test_unraid_host_envelope_projects_to_the_registered_contract() -> None:
    connector = UnraidConnector(
        FakeBrokerClient(), (RegisteredContainer("ludarium-web", PROJECT_ID, "prod"),)
    )
    schema = _output_schema("unraid-host-status.yaml")

    projected, warnings = _project_connector_output(connector.host_status(_context()), schema)

    assert list(Draft202012Validator(schema).iter_errors(projected)) == []
    assert projected["hostRef"] == "unraid"
    assert projected["generatedAt"]
    assert warnings == []


def test_catalog_marks_only_live_registered_connector_bindings_verified() -> None:
    expected = {
        "devrunbook": set(),
        "forgeflow": set(),
        "geointel": set(),
        "ludarium": {"knowledge-default", "gitea-default", "unraid-default"},
        "vacatureradar": {"knowledge-default", "gitea-default", "unraid-default"},
        "mobilityops": {"mobilityops-default"},
    }
    for slug, verified in expected.items():
        document = json.loads(
            (ROOT / "catalog" / "projects" / f"{slug}.yaml").read_text(encoding="utf-8")
        )
        actual = {
            binding["ref"]
            for binding in document["spec"]["connectorBindings"]
            if binding.get("verification") == "verified"
        }
        assert actual == verified