from __future__ import annotations

import io
import re
import shlex
import subprocess
import tarfile
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]


def test_windows_archive_preserves_git_bytes_with_autocrlf_enabled(tmp_path):
    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
    command = re.search(r"& (git(?: -c \S+)*) archive --format=tar", wrapper)
    assert command is not None
    prefix = shlex.split(command.group(1))
    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
    source = b"print('immutable source')\n"
    (tmp_path / "scripts").mkdir()
    (tmp_path / "scripts/run_repopulse_adoption.py").write_bytes(source)
    def git(*arguments):
        return subprocess.check_output(["git", "-C", str(tmp_path), *arguments])
    git("-c", "core.autocrlf=false", "add", "scripts/run_repopulse_adoption.py")
    git("-c", "commit.gpgsign=false", "-c", "user.name=Fixture", "-c",
        "user.email=fixture@example.invalid", "commit", "-qm", "fixed source")
    git("config", "core.autocrlf", "true")
    archive = subprocess.check_output([*prefix, "-C", str(tmp_path), "archive", "--format=tar",
                                       "HEAD", "scripts/run_repopulse_adoption.py"])
    with tarfile.open(fileobj=io.BytesIO(archive)) as packaged:
        assert packaged.extractfile("scripts/run_repopulse_adoption.py").read() == source


def test_windows_wrapper_archives_every_file_required_by_root_installer():
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")

    required = re.search(r"source_paths=\(\s*(.*?)\n\)", installer, re.DOTALL)
    archived = re.search(r"& git(?: -c \S+)* archive --format=tar .*? \$SourceRevision (.*?)\r?\n", wrapper)
    assert required is not None and archived is not None
    archive_paths = set(shlex.split(archived.group(1)))
    required_paths = shlex.split(required.group(1))
    assert all(
        path in archive_paths
        or any(path.startswith(f"{directory}/") for directory in archive_paths)
        for path in required_paths
    )
    vendor_sources = sorted(
        path.relative_to(ROOT).as_posix()
        for path in (ROOT / "scripts/vendor").rglob("*")
        if path.is_file() and (path.suffix == ".py" or path.name == "pyyaml-LICENSE")
    )
    required_vendor_sources = sorted(
        path for path in required_paths if path.startswith("scripts/vendor/")
    )
    assert vendor_sources == required_vendor_sources
    assert "scripts/prepare_controller_hub_release_volume.py" in archived.group(1)
    assert "ops/gitea-deploy-broker/forge_first_install.py" in required_paths
    assert "ops/gitea-deploy-broker/forge_database_credentials.py" in required_paths
    assert "ops/gitea-deploy-broker/forge_backup_paths.py" in required_paths
    assert "ops/gitea-deploy-broker/forge_secret_bundle.py" in required_paths
    assert "scripts/upgrade_deployment_controller.sh" in archived.group(1)
    assert "scripts/vendor" in archived.group(1)
    assert "scripts/vendor/pyyaml-LICENSE" in required.group(1)
    assert "scripts/vendor/yaml/__init__.py" in required.group(1)
    assert 'mkdir -m 0700 "${work}/vendor" "${work}/vendor/yaml"' in installer
    assert '"${work}/vendor/yaml/${vendor_file}"' in installer
    assert ('[[ -d "${script_dir}/vendor" && ! -L "${script_dir}/vendor" && '
            '-d "${script_dir}/vendor/yaml" && ! -L "${script_dir}/vendor/yaml" ]]') in installer
    assert "forge_first_install.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
    assert "forge_database_credentials.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
    assert "forge_backup_paths.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]
    assert "forge_secret_bundle.py" in installer.split("module_files=(", 1)[1].split(")", 1)[0]


def test_forge_first_install_module_is_bound_into_controller_release_and_config():
    renderer = (ROOT / "scripts/prepare_controller_artifact.py").read_text(encoding="utf-8")
    preparer = (ROOT / "scripts/prepare_controller_hub_release_volume.py").read_text(encoding="utf-8")

    assert '"forge_first_install.py"' in renderer.split("_ARTIFACT_FILES = (", 1)[1].split(")", 1)[0]
    release_files = preparer.split("RELEASE_FILES = (", 1)[1].split(")", 1)[0]
    legacy_role_release_files = preparer.split(
        "LEGACY_RELEASE_FILES_WITH_ROLE_HELPER = (", 1
    )[1].split(")", 1)[0]
    assert "'forge_first_install.py'" in legacy_role_release_files
    assert "'forge_database_credentials.py'" in legacy_role_release_files
    assert "*LEGACY_RELEASE_FILES_WITH_ROLE_HELPER" in release_files
    assert "'forge_backup_paths.py'" in release_files
    assert "'forge_secret_bundle.py'" in release_files
    assert "'forge-first-install.json'" in preparer.split("CONFIG_FILES = {", 1)[1].split("}", 1)[0]
    assert "'forge-bootstrap-secrets'" in preparer.split("CONFIG_SECRET_DIRS = {", 1)[1].split("}", 1)[0]


def test_windows_wrapper_supplies_private_archive_and_exact_image_identity():
    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")

    assert "mktemp -d -p /tmp 'itworx-controller-artifact-promoter-" in wrapper
    assert "^/tmp/itworx-controller-artifact-promoter-" in wrapper
    assert '"chmod 600 \'$remoteArchive\' && chmod 700 \'$remoteScript\'' in wrapper
    assert "docker inspect --format '{{.Image}}' gitea-deploy-control" in wrapper
    assert "-cnotmatch '^sha256:[0-9a-f]{64}$'" in wrapper
    assert "--image-id '$imageId'" in wrapper
    assert "--image-id) image_id=\"$2\"" in installer
    assert '[[ "$archive_parent" =~ ^/tmp/itworx-controller-artifact-promoter-' in installer


def test_observed_runner_tag_recovery_switch_is_fixed_and_prepare_only():
    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
    preparer = (ROOT / "scripts/prepare_controller_hub_release_volume.py").read_text(encoding="utf-8")

    assert "[switch]$AllowObservedRunnerTagDrift" in wrapper
    assert '$recoveryArgument = if ($AllowObservedRunnerTagDrift)' in wrapper
    assert "--allow-observed-runner-tag-drift" in wrapper
    assert "OBSERVED_RUNNER_IMAGE_REF = 'docker.gitea.com/runner-images:ubuntu-latest'" in preparer
    assert "--allow-observed-runner-tag-drift)" in installer
    assert "recovery_arguments+=(--allow-observed-runner-tag-drift)" in installer
    prepare_start = installer.index('backup="$(python3 "${work}/${PREPARER_NAME}" prepare')
    prepare_stop = installer.index('python3 "${work}/${PREPARER_NAME}" stop --backup "$backup"')
    prepare_command = installer[prepare_start:prepare_stop]
    assert '"${recovery_arguments[@]}"' in prepare_command
    assert "parser.add_argument('--allow-observed-runner-tag-drift', action='store_true')" in preparer
    assert "if args.allow_observed_runner_tag_drift and args.operation != 'prepare':" in preparer


def test_state_reconciliation_is_committed_only_after_volume_verification():
    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
    verify = installer.index('python3 "${work}/${PREPARER_NAME}" verify --backup "$backup"')
    commit = installer.index(
        'python3 "${work}/reconcile_controller_state.py" --journal-path "$migration_journal" --commit'
    )

    assert verify < commit
    assert installer.index("reconciliation_active=0", commit) > commit