import ast
import hashlib
import json
import os
import re
import subprocess
import tempfile
from datetime import datetime, timezone
from pathlib import Path
from types import SimpleNamespace

import pytest

from backend.app.services.mcp_hub_deployment_reconciliation import (
    McpHubDeploymentReconciliation,
)


class FakeResponse:
    def __init__(self, payload):
        self.payload = payload

    def json(self):
        return self.payload


class FakePortainer:
    def __init__(self, exit_code=0):
        self.exit_code = exit_code
        self.calls = []

    def get_container_status(self, name):
        assert name == "gitea-deploy-control"
        return {
            "status": "ok",
            "container": {
                "id": "controller-id",
                "name": "gitea-deploy-control",
                "state": "running",
            },
        }

    def _config(self):
        return SimpleNamespace(endpoint_id="3")

    def _request(self, method, path, **kwargs):
        self.calls.append((method, path, kwargs))
        if path.endswith("/containers/controller-id/exec"):
            return FakeResponse({"Id": "exec-1"})
        if path.endswith("/exec/exec-1/start"):
            return FakeResponse({})
        if path.endswith("/exec/exec-1/json"):
            return FakeResponse({"Running": False, "ExitCode": self.exit_code})
        raise AssertionError(path)


def test_reconciliation_is_fixed_and_read_only_for_mcp_hub():
    fake = FakePortainer()
    result = McpHubDeploymentReconciliation(fake).run()
    assert result == {
        "status": "reconciled",
        "repository": "jens/itworx_mcp_hub",
        "composeProject": "itworx-mcp-hub",
    }

    command = fake.calls[0][2]["json"]["Cmd"]
    assert command[:2] == ["python3", "-c"]
    assert command[3:] == ["jens/itworx_mcp_hub", "itworx-mcp-hub"]
    script = command[2]
    assert "/controller-config/projects.json" in script
    assert "/controller-hub-releases/controller-config/projects.json" in script
    assert "/mnt/cache/appdata/gitea-deploy-runners/state" in script
    assert "os.path.samefile(registry_path, host_registry_path)" in script
    assert 'os.open(project_lock_path, os.O_RDONLY' in script
    assert 'os.open(global_lock_path, os.O_RDONLY' in script
    assert 'state_root.mkdir' not in script
    assert 'project_lock_path.parent.mkdir' not in script
    assert 'os.replace(' not in script
    assert 'shutil.copy2(' not in script
    assert 'state_path.write_text(' not in script
    assert '"status": "success"' not in script
    assert '"live_legacy_provenance": True' not in script


def test_unknown_or_legacy_state_requires_the_guarded_deployment_path():
    result = McpHubDeploymentReconciliation(FakePortainer(exit_code=56)).run()
    assert result == {
        "status": "topology_migration_required",
        "repository": "jens/itworx_mcp_hub",
        "composeProject": "itworx-mcp-hub",
        "reason": "MCP Hub legacy, unknown, mixed, or unresolved migration state requires guarded deployment or data-aware recovery",
    }

    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    assert 'set(registered_live_containers) == expected_fixed' in script
    assert 'raise SystemExit(56 if recorded_live_status in {"unknown", "healthy"} else 52)' in script
    assert 'recorded_status == "success"' in script
    assert 'recorded_live_status == "healthy"' in script
    assert 'state.get("live_legacy_provenance") is False' in script
    assert 'recorded_artifacts.get("topology_contract") == topology_contract' in script
    assert 'receipt.get("schema") == "gitea-deploy-receipt.v1"' in script
    assert 'receipt.get("live") is None' in script


def test_modern_success_requires_a_complete_exact_receipt_and_protected_ancestry():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]

    assert 'set(receipt) == {"schema", "repository", "revision", "tree", "treeDigest", "build", "containers", "live"}' in script
    assert 'receipt_identity_valid' in script
    assert 'receipt.get("revision") == recorded_live' in script
    assert 'git_run("merge-base", "--is-ancestor", recorded_live, main_revision)' in script
    assert 'set(dict(receipt.get("containers") or {})) == expected_runtime' in script
    assert 'print("already-reconciled", flush=True)' in script
    assert 'print("reconciled", flush=True)' not in script
    assert 'migration_path = migration_root / "active-intent.json"' in script
    assert 'intent.get("status") != "complete"' in script
    assert 'elif migration_attempt_id:' in script
    assert 'intent.get("completedStateSha256") != hashlib.sha256(state_bytes).hexdigest()' in script
    assert 'observed.get("historicalStateSha256") != intent.get("baselineStateSha256")' in script
    assert 'rf"[0-9]+-{recorded_live[:12]}-[0-9a-f]{{16}}"' in script


def test_reconciliation_intent_guard_rejects_unknown_and_accepts_exact_complete_intent():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    parsed = ast.parse(script)
    function = next(
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef) and node.name == "validate_migration_intent_state"
    )
    namespace = {
        "Path": Path,
        "hashlib": hashlib,
        "json": json,
        "os": os,
        "re": re,
        "stat": SimpleNamespace(S_IMODE=lambda _mode: 0o600),
        "trusted_private_path": lambda *_args, **_kwargs: True,
    }
    exec(compile(ast.Module(body=[function], type_ignores=[]), "intent-test", "exec"), namespace)
    validate = namespace["validate_migration_intent_state"]
    repository = "jens/itworx_mcp_hub"
    candidate = "b" * 40
    migration_attempt = "a" * 32
    state_bytes = b"exact-success-state-bytes"

    for raw in (b'{"status":"started"}', b"not-json"):
        with tempfile.TemporaryDirectory() as temporary:
            state_root = Path(temporary)
            migration_root = state_root / "mcp-hub-topology-migrations"
            migration_root.mkdir()
            (migration_root / "active-intent.json").write_bytes(raw)
            last_attempt = {"metadata": {"mcpHubMigrationAttemptId": migration_attempt}}
            with pytest.raises(SystemExit) as exc:
                validate(
                    state_root, state_bytes, repository, candidate, "success", "healthy",
                    last_attempt, "success", candidate,
                )
            assert exc.value.code == 56

    with tempfile.TemporaryDirectory() as temporary:
        last_attempt = {"metadata": {"mcpHubMigrationAttemptId": migration_attempt}}
        with pytest.raises(SystemExit) as exc:
            validate(
                Path(temporary), state_bytes, repository, candidate, "success", "healthy",
                last_attempt, "success", candidate,
            )
        assert exc.value.code == 56

    with tempfile.TemporaryDirectory() as temporary:
        state_root = Path(temporary)
        migration_root = state_root / "mcp-hub-topology-migrations"
        migration_root.mkdir()
        intent = {
            "schema": "itworx.mcp-hub-migration-intent/v1",
            "status": "complete",
            "attemptId": migration_attempt,
            "repository": repository,
            "candidateRevision": candidate,
            "priorLiveRevision": "c" * 40,
            "backupManifestSha256": "d" * 64,
            "backupComposeSha256": "e" * 64,
            "baselineStateSha256": "f" * 64,
            "startedAtEpoch": 10,
            "completedAtEpoch": 11,
            "completedStateSha256": "0" * 64,
        }
        active_intent = migration_root / "active-intent.json"
        active_intent.write_text(json.dumps(intent), encoding="utf-8")
        last_attempt = {
            "metadata": {
                "mcpHubMigrationAttemptId": migration_attempt,
                "mcpHubBackupReceipt": {
                    "repository": repository,
                    "revision": candidate,
                    "restoreVerified": True,
                    "manifestSha256": "d" * 64,
                    "composeSha256": "e" * 64,
                },
            }
        }
        with pytest.raises(SystemExit) as exc:
            validate(
                state_root, state_bytes, repository, candidate, "success", "healthy",
                last_attempt, "success", candidate,
            )
        assert exc.value.code == 56

    with tempfile.TemporaryDirectory() as temporary:
        state_root = Path(temporary)
        migration_root = state_root / "mcp-hub-topology-migrations"
        receipt_root = state_root / "mcp-hub-backup-receipts"
        backup_root = state_root / "mcp-hub-backups"
        migration_root.mkdir()
        receipt_root.mkdir()
        backup_root.mkdir()
        backup_directory = backup_root / f"1780400000-{candidate[:12]}-0123456789abcdef"
        backup_directory.mkdir()
        compose_digest = "e" * 64
        manifest = {
            "schema": "itworx.mcp-hub-backup/v1",
            "repository": repository,
            "revision": candidate,
            "backupDirectory": str(backup_directory),
            "composeSha256": compose_digest,
            "configRestoreVerified": True,
            "restore": {"status": "verified"},
            "databases": {"itworx_mcp_hub": {}, "contextforge": {}},
        }
        manifest_path = backup_directory / "manifest.json"
        manifest_path.write_text(json.dumps(manifest), encoding="utf-8")
        manifest_digest = hashlib.sha256(manifest_path.read_bytes()).hexdigest()
        receipt_path = receipt_root / f"1780400000-{candidate[:12]}-0123456789abcdef.json"
        backup_receipt = {
            "schema": "itworx.mcp-hub-backup-receipt/v1",
            "repository": repository,
            "revision": candidate,
            "backupDirectory": str(backup_directory),
            "manifestSha256": manifest_digest,
            "composeSha256": compose_digest,
            "restoreVerified": True,
            "createdAtEpoch": 1780400000,
            "receiptPath": str(receipt_path),
        }
        receipt_path.write_text(
            json.dumps({key: value for key, value in backup_receipt.items() if key != "receiptPath"}),
            encoding="utf-8",
        )
        observed_path = migration_root / f"observed-baseline-{candidate[:12]}-0123456789abcdef0123.json"
        observed = {
            "schema": "itworx.mcp-hub-observed-baseline/v1",
            "claim": "observed_mixed_runtime_facts_only",
            "candidateRevision": candidate,
            "historicalStateSha256": "f" * 64,
            "backupManifestSha256": manifest_digest,
            "backupComposeSha256": compose_digest,
            "backupRestoreVerified": True,
            "postgresVolumeBaseline": [{}, {}],
        }
        observed_path.write_text(json.dumps(observed), encoding="utf-8")
        observed_digest = hashlib.sha256(observed_path.read_bytes()).hexdigest()
        successful_state_sha = hashlib.sha256(state_bytes).hexdigest()
        intent = {
            "schema": "itworx.mcp-hub-migration-intent/v1",
            "status": "complete",
            "attemptId": migration_attempt,
            "repository": repository,
            "candidateRevision": candidate,
            "priorLiveRevision": "c" * 40,
            "backupManifestSha256": manifest_digest,
            "backupComposeSha256": compose_digest,
            "baselineStateSha256": "f" * 64,
            "startedAtEpoch": 10,
            "completedAtEpoch": 11,
            "completedStateSha256": successful_state_sha,
            "observedBaselinePath": str(observed_path),
            "observedBaselineSha256": observed_digest,
        }
        (migration_root / "active-intent.json").write_text(json.dumps(intent), encoding="utf-8")
        last_attempt = {
            "metadata": {
                "mcpHubMigrationAttemptId": migration_attempt,
                "mcpHubBackupReceipt": backup_receipt,
            }
        }

        validate(
            state_root, state_bytes, repository, candidate, "success", "healthy",
            last_attempt, "success", candidate,
        )


def test_container_reverification_requires_exact_health_service_label_ids_and_mounts():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]

    assert 'runtime_state.get("Running") is not True or health != "healthy"' in script
    assert 'labels.get("com.docker.compose.project") != expected_compose_project' in script
    assert 'labels.get("com.docker.compose.service") != name_service' in script
    assert 'if recorded.get(key) != value or receipt_item.get(key) != value:' in script
    assert 'live_attested_mounts(container) != recorded_mounts' in script
    assert 'receipt_item.get("mounts_sha256")' in script
    assert 'def live_attested_mounts(container):' in script
    assert 'docker", "volume", "inspect", name' in script
    assert 'mount["created_at"] = created_at' in script
    assert 'created.astimezone(timezone.utc) > datetime.now(timezone.utc)' in script


def test_reconciliation_distinguishes_recreated_postgres_volume_by_created_at():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    parsed = ast.parse(script)
    function = next(
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef) and node.name == "live_attested_mounts"
    )
    volume = {
        "Name": "hub-postgres",
        "Driver": "local",
        "Mountpoint": "/var/lib/docker/volumes/hub-postgres/_data",
        "Options": {},
        "CreatedAt": "2020-01-01T10:00:00Z",
    }
    namespace = {
        "json": json,
        "os": os,
        "subprocess": SimpleNamespace(
            PIPE=subprocess.PIPE,
            DEVNULL=subprocess.DEVNULL,
            run=lambda *_args, **_kwargs: SimpleNamespace(
                returncode=0, stdout=json.dumps([volume])
            )
        ),
        "datetime": datetime,
        "timezone": timezone,
    }
    exec(compile(ast.Module(body=[function], type_ignores=[]), "mount-test", "exec"), namespace)
    attest = namespace["live_attested_mounts"]
    container = {
        "Mounts": [{
            "Type": "volume", "Name": "hub-postgres",
            "Source": "/var/lib/docker/volumes/hub-postgres/_data",
            "Destination": "/var/lib/postgresql/data", "Driver": "local", "RW": True,
        }]
    }

    original = attest(container)
    assert original[0]["created_at"] == "2020-01-01T10:00:00Z"
    volume["CreatedAt"] = "2021-01-01T10:00:00Z"
    recreated = attest(container)
    assert recreated[0]["name"] == original[0]["name"]
    assert recreated[0]["source"] == original[0]["source"]
    assert recreated[0]["created_at"] != original[0]["created_at"]


def test_each_service_uses_its_fixed_image_repository_or_reviewed_external_contract():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]

    assert 'def fixed_image_reference(service_name, image_ref):' in script
    assert '"dataplane-router": "gitea.example.com/jens/itworx-mcp-hub/dataplane"' in script
    assert '"docker-read-broker": "gitea.example.com/jens/itworx-mcp-hub/docker-read-broker"' in script
    assert 'artifact["image_source"] != owned_image_source' in script
    assert 'artifact["image_revision"] != recorded_live' in script
    assert 'main_declares_external_image(image_ref)' in script
    assert 'main_declares_contextforge_compat_image(' in script
    assert 'def image_digest_matches(image, image_ref):' in script
    assert 'aliases.add("docker.io/library/" + repository)' in script


def test_external_candidate_pins_are_exact_and_declared_by_protected_main():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    parsed = ast.parse(script)
    function = next(
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef) and node.name == "fixed_image_reference"
    )
    postgres = (
        "gitea.example.com/jens/itworx-mcp-hub/postgres:"
        "wp400-gosu-v2-20261002-a94e0b4d2029@sha256:"
        "a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73"
    )
    redis = (
        "gitea.example.com/jens/itworx-mcp-hub/redis:"
        "wp400-remediation-20261002-4e18f61c@sha256:"
        "7d826b44f245ad32e8fe4bf40d42eae95855c3942c5f2e42784ee8fd3f9547a2"
    )
    previous_postgres = (
        "postgres:18.6@sha256:"
        "0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04"
    )
    previous_redis = (
        "redis:8.10.2@sha256:"
        "7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48"
    )
    declared = {previous_postgres, previous_redis, postgres, redis}
    namespace = {
        "re": re,
        "main_declares_external_image": lambda image_ref: image_ref in declared,
        "main_declares_sessionless_dataplane_image": lambda *_args: False,
        "main_declares_contextforge_compat_image": lambda *_args: False,
    }
    exec(compile(ast.Module(body=[function], type_ignores=[]), "fixed-image-test", "exec"), namespace)
    fixed = namespace["fixed_image_reference"]

    assert fixed("postgres", "postgres:18.4@sha256:3a82e1f56c8f0f5616a11103ac3d47e632c3938698946a7ad26da0df1334744a")
    assert fixed("postgres", "postgres:18.6@sha256:0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04")
    assert fixed("redis", "redis:8.10.0@sha256:c29e49ab2f85760a3827b53882e6dd9f5c6c3f0bb7d724e07bb31cbf275a5236")
    assert fixed("redis", "redis:8.10.2@sha256:7ef5b5cec96495a04ca7feff88a9492efeab8053fb284d24bdd73344c9245a48")
    assert fixed("postgres", postgres)
    assert fixed("redis", redis)
    assert not fixed("redis", postgres)
    assert not fixed("postgres", postgres[:-1] + "4")
    assert not fixed("postgres", postgres.replace("wp400-gosu-v2-20261002-a94e0b4d2029", "wp400-gosu-v2-20261002-wrong"))
    assert not fixed("postgres", postgres.replace("gitea.example.com/jens/itworx-mcp-hub", "gitea.example.com/other/itworx-mcp-hub"))
    assert not fixed("redis", redis[:-1] + "3")
    assert not fixed("redis", redis.replace("wp400-remediation-20261002-4e18f61c", "wp400-remediation-20261002-wrong"))
    assert not fixed("redis", redis.replace("gitea.example.com/jens/itworx-mcp-hub", "gitea.example.com/other/itworx-mcp-hub"))
    assert not fixed("postgres", "postgres:19.0@sha256:" + "a" * 64)
    assert not fixed("redis", "redis:8.10.3@sha256:" + "b" * 64)
    for service in ("web", "control-api", "dataplane-router", "connector-ingestion"):
        assert fixed(service, "sha256:" + "a" * 64)
    for service in ("postgres", "redis", "contextforge", "ingestion-clamd", "foreign"):
        assert not fixed(service, "sha256:" + "a" * 64)

    namespace["main_declares_external_image"] = lambda _image_ref: False
    assert fixed("postgres", "postgres:18.4@sha256:3a82e1f56c8f0f5616a11103ac3d47e632c3938698946a7ad26da0df1334744a")
    assert not fixed("postgres", previous_postgres)
    assert fixed("redis", "redis:8.10.0@sha256:c29e49ab2f85760a3827b53882e6dd9f5c6c3f0bb7d724e07bb31cbf275a5236")
    assert not fixed("redis", previous_redis)
    assert not fixed("postgres", postgres)
    assert not fixed("redis", redis)


@pytest.mark.parametrize("service, image_ref", [
    (
        "postgres",
        "gitea.example.com/jens/itworx-mcp-hub/postgres:"
        "wp400-gosu-v2-20261002-a94e0b4d2029@sha256:"
        "a60d81e06987671ae903757f1b71cdfbbff4d481b42610e4de2b7dcfa32aad73",
    ),
    (
        "redis",
        "gitea.example.com/jens/itworx-mcp-hub/redis:"
        "wp400-remediation-20261002-4e18f61c@sha256:"
        "7d826b44f245ad32e8fe4bf40d42eae95855c3942c5f2e42784ee8fd3f9547a2",
    ),
])
def test_new_db_pin_requires_exact_protected_main_compose_declaration(service, image_ref):
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    parsed = ast.parse(script)
    function = next(
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef) and node.name == "main_declares_external_image"
    )
    main_revision = "a" * 40
    content = {"value": f"services:\n  {service}:\n    image: {image_ref}\n"}
    calls = []

    def git_run(*args):
        calls.append(args)
        return subprocess.CompletedProcess(args, 0, stdout=content["value"])

    namespace = {"re": re, "main_revision": main_revision, "git_run": git_run}
    exec(compile(ast.Module(body=[function], type_ignores=[]), "main-image-declaration-test", "exec"), namespace)
    declares = namespace["main_declares_external_image"]
    assert declares(image_ref)
    assert calls == [("show", f"{main_revision}:infrastructure/compose/docker-compose.yml")]

    calls.clear()
    content["value"] = f"services:\n  {service}:\n    image: {image_ref[:-1]}0\n"
    assert not declares(image_ref)
    assert calls == [
        ("show", f"{main_revision}:infrastructure/compose/docker-compose.yml"),
        ("show", f"{main_revision}:infrastructure/compose/docker-compose.prod.yml"),
    ]


@pytest.fixture
def contextforge_reconciliation_proof():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    parsed = ast.parse(fake.calls[0][2]["json"]["Cmd"][2])
    functions = [
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef)
        and node.name in {
            "main_declares_contextforge_compat_image", "fixed_image_reference",
            "receipt_bound_image_reference",
        }
    ]
    revision = "a" * 40
    main_revision = "b" * 40
    manifest = (
        f"CONTEXTFORGE_UPSTREAM_COMMIT={'c' * 40}\n"
        "CONTEXTFORGE_ALEMBIC_HEAD=123456789abc\n"
        "CONTEXTFORGE_MCP_SDK=1.2.3\n"
        "CONTEXTFORGE_LOCAL_IMAGE=itworx-mcp-hub/contextforge-schema:123456789abc\n"
    )
    builder = (
        'git -C "$SRC" fetch --depth 1 origin "$CONTEXTFORGE_UPSTREAM_COMMIT"\n'
        'git -C "$SRC" checkout --detach FETCH_HEAD\n'
        'MCP_REQUIREMENT="mcp==${CONTEXTFORGE_MCP_SDK}"\n'
        'alembic -c mcpgateway/alembic.ini heads\n'
        'docker tag "$STAGED_IMAGE" "$CONTEXTFORGE_LOCAL_IMAGE"\n'
        '--release-candidate\n'
        'CANDIDATE_IMAGE="itworx-mcp-hub/contextforge-schema:${APPOPS_SOURCE_REVISION}"\n'
        'docker tag "$STAGED_IMAGE" "$CANDIDATE_IMAGE"\n'
    )
    files = {
        f"{commit}:infrastructure/images/contextforge/compat-image.env": manifest
        for commit in (revision, main_revision)
    }
    files.update({
        f"{commit}:scripts/build_contextforge_compat_image.sh": builder
        for commit in (revision, main_revision)
    })

    def git_run(*args):
        assert args[0] == "show"
        return SimpleNamespace(returncode=0 if args[1] in files else 1,
                               stdout=files.get(args[1], ""))

    namespace = {"re": re, "git_run": git_run, "main_revision": main_revision,
                 "recorded_live": revision}
    exec(  # noqa: S102 -- Execute only extracted repository-owned verifier functions.
        compile(ast.Module(body=functions, type_ignores=[]), "contextforge-proof", "exec"), namespace
    )
    return SimpleNamespace(namespace=namespace, files=files, revision=revision)


def test_contextforge_reconciliation_accepts_exact_receipt_revision(contextforge_reconciliation_proof):
    proof = contextforge_reconciliation_proof
    namespace = proof.namespace
    fixed = namespace["fixed_image_reference"]
    reference = f"itworx-mcp-hub/contextforge-schema:{proof.revision}"
    image_id = "sha256:" + "d" * 64
    record = {"image_id": image_id, "image_ref": reference}
    bound = namespace["receipt_bound_image_reference"](image_id, image_id, record, dict(record))
    assert fixed("contextforge", bound)
    assert fixed("contextforge", "itworx-mcp-hub/contextforge-schema:123456789abc")
    # A later main may remove the candidate builder; the recorded receipt's
    # ancestor revision must supply the source proof for this immutable image.
    proof.files[f"{'b' * 40}:scripts/build_contextforge_compat_image.sh"] = ""
    assert fixed("contextforge", bound)


@pytest.mark.parametrize("mutation", [
    "wrong_revision", "short_revision", "mutable_tag", "wrong_service",
    "missing_candidate_flag", "missing_candidate_assignment", "missing_candidate_tag",
    "missing_fetch", "bad_manifest", "missing_recorded_source",
])
def test_contextforge_reconciliation_rejects_unbound_candidates(contextforge_reconciliation_proof, mutation):
    proof = contextforge_reconciliation_proof
    reference = f"itworx-mcp-hub/contextforge-schema:{proof.revision}"
    service = "contextforge"
    builder_path = f"{proof.revision}:scripts/build_contextforge_compat_image.sh"
    fragments = {
        "missing_candidate_flag": '--release-candidate',
        "missing_candidate_assignment": 'CANDIDATE_IMAGE="itworx-mcp-hub/contextforge-schema:${APPOPS_SOURCE_REVISION}"',
        "missing_candidate_tag": 'docker tag "$STAGED_IMAGE" "$CANDIDATE_IMAGE"',
        "missing_fetch": 'git -C "$SRC" fetch --depth 1 origin "$CONTEXTFORGE_UPSTREAM_COMMIT"',
    }
    if mutation == "wrong_revision":
        reference = f"itworx-mcp-hub/contextforge-schema:{'b' * 40}"
    elif mutation == "short_revision":
        reference = f"itworx-mcp-hub/contextforge-schema:{proof.revision[:12]}"
    elif mutation == "mutable_tag":
        reference = "itworx-mcp-hub/contextforge-schema:latest"
    elif mutation == "wrong_service":
        service = "foreign"
    elif mutation in fragments:
        proof.files[builder_path] = proof.files[builder_path].replace(fragments[mutation], "")
    elif mutation == "bad_manifest":
        path = f"{proof.revision}:infrastructure/images/contextforge/compat-image.env"
        proof.files[path] = proof.files[path].replace("CONTEXTFORGE_ALEMBIC_HEAD=123456789abc", "CONTEXTFORGE_ALEMBIC_HEAD=invalid")
    else:
        proof.files.pop(builder_path)
    assert not proof.namespace["fixed_image_reference"](service, reference)


def test_digest_attestation_normalizes_tagged_docker_hub_repo_digests():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    parsed = ast.parse(script)
    function = next(
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef) and node.name == "image_digest_matches"
    )
    namespace = {"re": re}
    exec(compile(ast.Module(body=[function], type_ignores=[]), "reconcile-test", "exec"), namespace)
    matches = namespace["image_digest_matches"]
    digest = "sha256:" + "a" * 64

    assert matches({"RepoDigests": [f"postgres@{digest}"]}, f"postgres:18.6@{digest}")
    assert matches({"RepoDigests": [f"docker.io/library/redis@{digest}"]}, f"redis:8.10.2@{digest}")
    assert matches({"RepoDigests": [f"clamav/clamav@{digest}"]}, f"clamav/clamav:1.4.6@{digest}")
    assert matches(
        {"RepoDigests": [f"registry.example:5000/team/web@{digest}"]},
        f"registry.example:5000/team/web:release@{digest}",
    )
    assert not matches(
        {"RepoDigests": [f"redis@sha256:{'b' * 64}"]}, f"redis:8.10.2@{digest}"
    )
    assert not matches({"RepoDigests": [f"foreign/redis@{digest}"]}, f"redis:8.10.2@{digest}")


def test_id_launched_image_uses_exact_state_and_receipt_reference():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]
    parsed = ast.parse(script)
    function = next(
        node for node in parsed.body
        if isinstance(node, ast.FunctionDef) and node.name == "receipt_bound_image_reference"
    )
    namespace = {"re": re}
    exec(  # noqa: S102
        compile(ast.Module(body=[function], type_ignores=[]), "receipt-image-test", "exec"),
        namespace,
    )
    bound_reference = namespace["receipt_bound_image_reference"]
    image_id = "sha256:" + "a" * 64
    image_ref = (
        "postgres:18.6@sha256:"
        "0377e72c5289ed2f98cf61b1a9c2db9eb9d300317fe14244492fbc94343b3d04"
    )
    recorded = {"image_id": image_id, "image_ref": image_ref}
    receipt_item = dict(recorded)

    assert bound_reference(image_id, image_id, recorded, receipt_item) == image_ref
    assert bound_reference(image_ref, image_id, recorded, receipt_item) == image_ref
    assert 'image_ref = receipt_bound_image_reference(' in script
    assert script.index('image_ref = receipt_bound_image_reference(') < script.index(
        'if not fixed_image_reference(name_service, image_ref):'
    )
    assert 'image_digest_matches(image, image_ref)' in script

    for launch_image, live_id, state, receipt in (
        ("sha256:" + "c" * 64, image_id, recorded, receipt_item),
        (
            image_id, image_id,
            {**recorded, "image_id": "sha256:" + "c" * 64}, receipt_item,
        ),
        (
            image_id, image_id,
            recorded, {**receipt_item, "image_id": "sha256:" + "c" * 64},
        ),
        (
            image_id, image_id,
            {**recorded, "image_ref": "redis:8.10.2@sha256:" + "b" * 64},
            receipt_item,
        ),
        (image_id, image_id, recorded, {**receipt_item, "image_ref": ""}),
        (image_id, "arbitrary-image-id", recorded, receipt_item),
        (image_id, image_id,
         {**recorded, "image_ref": "sha256:" + "b" * 64},
         {**receipt_item, "image_ref": "sha256:" + "b" * 64}),
    ):
        with pytest.raises(SystemExit) as exc:
            bound_reference(launch_image, live_id, state, receipt)
        assert exc.value.code == 52


def test_reconciliation_reports_invalid_state_and_live_evidence_fail_closed():
    expected = {
        42: ("validation_failed", "MCP Hub deployment state file is unavailable or invalid"),
        45: ("validation_failed", "a live MCP Hub container is not running and healthy"),
        47: ("validation_failed", "live MCP Hub Compose project differs from the controller target"),
        51: ("validation_failed", "live MCP Hub image revision or external immutable image is not proven by the recorded-live to main chain"),
        52: ("validation_failed", "controller state or live facts do not match the exact modern MCP Hub receipt"),
        56: ("topology_migration_required", "MCP Hub legacy, unknown, mixed, or unresolved migration state requires guarded deployment or data-aware recovery"),
    }
    for exit_code, (status, reason) in expected.items():
        result = McpHubDeploymentReconciliation(FakePortainer(exit_code=exit_code)).run()
        assert result["status"] == status
        assert result["reason"] == reason


def test_reconciliation_only_allows_fixed_17_topology_and_rejects_registry_drift():
    fake = FakePortainer()
    McpHubDeploymentReconciliation(fake).run()
    script = fake.calls[0][2]["json"]["Cmd"][2]

    assert 'project.get("branch") != "main"' in script
    assert 'project.get("slug") != expected_compose_project' in script
    assert 'project.get("compose_project") != expected_compose_project' in script
    assert 'frozenset(expected_containers) not in {frozenset(expected_fixed), frozenset(expected_runtime)}' in script
    assert 'set(expected_containers) != expected_runtime' in script
    assert 'set(project_names) != set(expected_containers)' in script
    assert '"itworx-mcp-hub-connector-ingestion-1"' in script
    assert '"itworx-mcp-hub-ingestion-clamd-1"' in script