from __future__ import annotations

import re
import shlex
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]


def test_windows_wrapper_archives_every_file_required_by_root_installer():
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")

    required = re.search(r"source_paths=\(\s*(.*?)\n\)", installer, re.DOTALL)
    archived = re.search(r"& git archive --format=tar .*? \$SourceRevision (.*?)\r?\n", wrapper)
    assert required is not None and archived is not None
    archive_paths = set(shlex.split(archived.group(1)))
    required_paths = shlex.split(required.group(1))
    assert all(
        path in archive_paths
        or any(path.startswith(f"{directory}/") for directory in archive_paths)
        for path in required_paths
    )
    vendor_sources = sorted(
        path.relative_to(ROOT).as_posix()
        for path in (ROOT / "scripts/vendor").rglob("*")
        if path.is_file() and (path.suffix == ".py" or path.name == "pyyaml-LICENSE")
    )
    required_vendor_sources = sorted(
        path for path in required_paths if path.startswith("scripts/vendor/")
    )
    assert vendor_sources == required_vendor_sources
    assert "scripts/prepare_controller_hub_release_volume.py" in archived.group(1)
    assert "ops/gitea-deploy-broker/forge_first_install.py" in required_paths
    assert "ops/gitea-deploy-broker/forge_database_credentials.py" in required_paths
    assert "ops/gitea-deploy-broker/forge_backup_paths.py" in required_paths
    assert "ops/gitea-deploy-broker/forge_secret_bundle.py" in required_paths
    assert "scripts/upgrade_deployment_controller.sh" in archived.group(1)
    assert "scripts/vendor" in archived.group(1)
    assert "scripts/vendor/pyyaml-LICENSE" in required.group(1)
    assert "scripts/vendor/yaml/__init__.py" in required.group(1)
    assert 'mkdir -m 0700 "${work}/vendor" "${work}/vendor/yaml"' in installer
    assert '"${work}/vendor/yaml/${vendor_file}"' in installer
    assert ('[[ -d "${script_dir}/vendor" && ! -L "${script_dir}/vendor" && '
            '-d "${script_dir}/vendor/yaml" && ! -L "${script_dir}/vendor/yaml" ]]') in installer
    assert "forge_first_install.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
    assert "forge_database_credentials.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
    assert "forge_backup_paths.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
    assert "forge_secret_bundle.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]


def test_forge_first_install_module_is_bound_into_controller_release_and_config():
    renderer = (ROOT / "scripts/prepare_controller_artifact.py").read_text(encoding="utf-8")
    preparer = (ROOT / "scripts/prepare_controller_hub_release_volume.py").read_text(encoding="utf-8")

    assert '"forge_first_install.py"' in renderer.split("_ARTIFACT_FILES = (", 1)[1].split(")", 1)[0]
    release_files = preparer.split("RELEASE_FILES = (", 1)[1].split(")", 1)[0]
    legacy_role_release_files = preparer.split(
        "LEGACY_RELEASE_FILES_WITH_ROLE_HELPER = (", 1
    )[1].split(")", 1)[0]
    assert "'forge_first_install.py'" in legacy_role_release_files
    assert "'forge_database_credentials.py'" in legacy_role_release_files
    assert "*LEGACY_RELEASE_FILES_WITH_ROLE_HELPER" in release_files
    assert "'forge_backup_paths.py'" in release_files
    assert "'forge_secret_bundle.py'" in release_files
    assert "'forge-first-install.json'" in preparer.split("CONFIG_FILES = {", 1)[1].split("}", 1)[0]
    assert "'forge-bootstrap-secrets'" in preparer.split("CONFIG_SECRET_DIRS = {", 1)[1].split("}", 1)[0]


def test_windows_wrapper_supplies_private_archive_and_exact_image_identity():
    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")

    assert "mktemp -d -p /tmp 'itworx-controller-artifact-promoter-" in wrapper
    assert "^/tmp/itworx-controller-artifact-promoter-" in wrapper
    assert '"chmod 600 \'$remoteArchive\' && chmod 700 \'$remoteScript\'' in wrapper
    assert "docker inspect --format '{{.Image}}' gitea-deploy-control" in wrapper
    assert "-cnotmatch '^sha256:[0-9a-f]{64}$'" in wrapper
    assert "--image-id '$imageId'" in wrapper
    assert "--image-id) image_id=\"$2\"" in installer
    assert '[[ "$archive_parent" =~ ^/tmp/itworx-controller-artifact-promoter-' in installer


def test_state_reconciliation_is_committed_only_after_volume_verification():
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
    verify = installer.index('python3 "${work}/${PREPARER_NAME}" verify --backup "$backup"')
    commit = installer.index(
        'python3 "${work}/reconcile_controller_state.py" --journal-path "$migration_journal" --commit'
    )

    assert verify < commit
    assert installer.index("reconciliation_active=0", commit) > commit