from __future__ import annotations

import json
from pathlib import Path

from services.control_api.catalog.loader import CatalogLoader

ROOT = Path(__file__).resolve().parents[1]
PROJECTS = ("ludarium", "vacatureradar", "forgeflow", "geointel", "devrunbook")
LOCAL_ROOTS = {
    "ludarium": Path(r"C:\Projects\Ludarium"),
    "vacatureradar": Path(r"C:\Projects\VacatureRadar"),
    "forgeflow": Path(r"C:\Projects\ForgeFlow"),
    "geointel": Path(r"C:\Projects\geointel"),
    "devrunbook": Path(r"C:\Projects\DevRunbook"),
}


def catalog(slug: str) -> dict:
    return json.loads((ROOT / "catalog/projects" / f"{slug}.yaml").read_text(encoding="utf-8"))


def test_all_known_projects_have_deny_first_scoped_virtual_servers() -> None:
    report = CatalogLoader(ROOT / "catalog").load()
    assert report.valid, report.issues
    assert {catalog(slug)["metadata"]["slug"] for slug in PROJECTS} == set(PROJECTS)
    for slug in PROJECTS:
        document = catalog(slug)
        servers = document["spec"]["virtualServers"]
        assert servers
        for server in servers:
            assert server["endpointAlias"] == f"/mcp/{slug}/{server['environment']}"
            assert server["defaultDecision"] == "deny"
            assert any(
                pattern.startswith(f"itworx-project://{slug}/")
                for pattern in server["resourceAllowPatterns"]
            )
            assert all(
                slug not in pattern or pattern.startswith(("itworx-project://", "itworx-docs://"))
                for pattern in server["resourceAllowPatterns"]
            )
        assert (
            "project-reader" in document["spec"]["capabilityPacks"]
            or slug == "general-infrastructure"
        )


def test_local_sources_are_evidence_backed_and_remote_mappings_are_not_guessed() -> None:
    inventory = json.loads(
        (ROOT / "evidence/WP-145/ONBOARDING_INVENTORY.json").read_text(encoding="utf-8")
    )
    assert {item["project"] for item in inventory} == set(PROJECTS)
    for item in inventory:
        root = Path(item["localRoot"])
        assert root == LOCAL_ROOTS[item["project"]]
        assert item["gitPresent"] is True
        assert item["sourceChecks"]["readme"] is True
        assert item["sourceChecks"]["docs"] is True
        assert item["knowledgeSourceMapping"] == "verified-local-filesystem"
        assert item["repositoryMapping"] == "external-input-required"
        assert item["giteaSmoke"] == "external-input-required"
        assert item["unraidSmoke"] == "external-input-required"
    assert catalog("forgeflow")["spec"]["repository"]["exposeMetadata"] == "never-public"


def test_project_connector_visibility_is_explicitly_scoped() -> None:
    for slug in PROJECTS:
        bindings = catalog(slug)["spec"]["connectorBindings"]
        refs = {binding["ref"] for binding in bindings}
        assert "knowledge-default" in refs
        assert all(binding["environments"] for binding in bindings)
        assert all(
            binding["verification"]
            in {"verified", "external-input-required", "unverified", "fake-only"}
            for binding in bindings
        )
        for server in catalog(slug)["spec"]["virtualServers"]:
            patterns = server["toolAllowPatterns"]
            assert "project.status.get" in patterns
            assert "knowledge.*" in patterns
            assert not any(
                pattern.startswith("*") and "project" not in pattern for pattern in patterns
            )