from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]


def test_canonical_compose_keeps_runtime_data_outside_the_source_checkout():
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
    dockerignore = (ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines()
    gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines()

    assert "${APPOPS_DATA_PATH:-./data}:/data" in compose
    assert "APPOPS_SECRET_KEY_FILE: /data/secret-key" in compose
    assert "- .:/data" not in compose
    assert "data" in dockerignore
    assert "/data/" in gitignore


def test_canonical_compose_uses_explicit_publish_host_and_persistent_voice_token():
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
    entrypoint = (ROOT / "docker" / "entrypoint.sh").read_text(encoding="utf-8")

    assert "${APPOPS_PUBLISH_HOST:-127.0.0.1}:1216:1216" in compose
    assert "APP_OPS_VOICE_TOKEN_FILE=/data/voice-token" in dockerfile
    assert 'generate_service_token "true" "${APP_OPS_VOICE_TOKEN:-}"' in entrypoint
    assert '"${APP_OPS_VOICE_TOKEN_FILE:-${DATA_DIR}/voice-token}"' in entrypoint


def test_canonical_compose_keeps_reverse_proxy_network_after_redeploy():
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")

    assert "- appops_proxy" in compose
    assert "external: true" in compose
    assert "name: ${APPOPS_PROXY_NETWORK:-itworx-mcp-hub-npm}" in compose


def test_canonical_compose_forwards_trusted_operator_proxy_configuration():
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")

    assert 'APPOPS_OPERATOR_PROXY_AUTH: "${APPOPS_OPERATOR_PROXY_AUTH:-false}"' in compose
    assert 'APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS: "${APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS:-}"' in compose
    assert 'APPOPS_OPERATOR_PROXY_USERS: "${APPOPS_OPERATOR_PROXY_USERS:-}"' in compose
    assert 'APPOPS_OPERATOR_PROXY_GROUPS: "${APPOPS_OPERATOR_PROXY_GROUPS:-appops-operators}"' in compose


def test_canonical_compose_mounts_only_the_file_based_gitea_observer_secret():
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")

    assert "GITEA_URL: https://gitea.example.com" in compose
    assert "GITEA_ADMIN_TOKEN_FILE: /data/gitea-admin-token" in compose
    assert "GITEA_ADMIN_TOKEN:" not in compose
    assert (
        "GITEA_RUNNER_TARGETS_JSON: '{}'"
        in compose
    )


def test_runtime_image_label_matches_the_app_version():
    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
    version = (ROOT / "backend/app/core/version.py").read_text(encoding="utf-8")

    expected_provenance = {
        "APPOPS_BUILD_ID": "org.opencontainers.image.version",
        "APPOPS_SOURCE_REVISION": "org.opencontainers.image.revision",
        "APPOPS_SOURCE_REPOSITORY": "org.opencontainers.image.source",
        "APPOPS_SOURCE_TREE": "org.opencontainers.image.source-tree",
        "APPOPS_BUILD_DATE": "org.opencontainers.image.created",
    }
    for build_argument, image_label in expected_provenance.items():
        assert f"ARG {build_argument}=" in dockerfile
        assert f'{image_label}="${{{build_argument}}}"' in dockerfile
        assert f'{build_argument}: "${{{build_argument}:-' in compose

    assert 'io.itworx.app.version="1.8.0"' in dockerfile
    assert 'io.itworx.app.operator-auth="http-only-session"' in dockerfile
    assert 'APP_VERSION = "1.8.0"' in version


def test_unraid_upgrade_can_restore_voice_token_without_logging_it():
    script = (ROOT / "scripts" / "upgrade_single_1216.sh").read_text(encoding="utf-8")

    assert "for env_key in \\\n  APP_OPS_VOICE_TOKEN \\" in script
    assert 'printf \'%s=%s\\n\' "$env_key" "$env_value" >> "$ENV_FILE"' in script
    assert 'log "${env_value}"' not in script