from __future__ import annotations

import subprocess
import re
from pathlib import Path


ROOT = Path(__file__).resolve().parents[3]
INSTALLER = ROOT / "scripts" / "reboot-recovery" / "install-reboot-auto-recovery-slo-110.sh"
SERVICE = ROOT / "scripts" / "reboot-recovery" / "awoooi-reboot-auto-recovery-slo.service"
EXPORTER = ROOT / "scripts" / "reboot-recovery" / "reboot-auto-recovery-slo-exporter.sh"


def test_installer_dry_run_exposes_apply_rollback_and_verify_contract() -> None:
    result = subprocess.run(
        ["bash", str(INSTALLER), "--dry-run"],
        text=True,
        capture_output=True,
        check=True,
    )

    assert "DRY_RUN=1" in result.stdout
    assert "target_selector=host_110_systemd_timer:awoooi-reboot-auto-recovery-slo.timer" in result.stdout
    assert "rollback_command=bash scripts/reboot-recovery/install-reboot-auto-recovery-slo-110.sh --rollback" in result.stdout
    assert "verify_command=bash scripts/reboot-recovery/install-reboot-auto-recovery-slo-110.sh --verify-only" in result.stdout
    assert "would_include_source_gates=" in result.stdout
    assert "would_enable_timer=awoooi-reboot-auto-recovery-slo.timer" in result.stdout


def test_installer_is_limited_to_verifier_timer_not_product_restarts() -> None:
    text = INSTALLER.read_text(encoding="utf-8")
    executable_text = "\n".join(
        line for line in text.splitlines() if not line.lstrip().startswith("#")
    )
    forbidden_fragments = [
        "shutdown",
        "systemctl restart docker",
        "systemctl restart nginx",
        "systemctl restart k3s",
        "systemctl restart postgresql",
        "systemctl restart redis",
        "docker restart",
        "kubectl drain",
        "iptables ",
        "ufw ",
        "DROP ",
        "TRUNCATE ",
        "gh ",
        "github.com",
    ]

    for fragment in forbidden_fragments:
        assert fragment not in executable_text
    assert re.search(r"(?m)^\s*(sudo\s+)?reboot(\s|$)", executable_text) is None
    assert "systemctl enable --now" in text
    assert "systemctl start ${UNIT_NAME}.service" in text
    assert 'payload_dir="$(mktemp -d "${TMPDIR:-/tmp}/${UNIT_NAME}.XXXXXX")"' in text
    assert 'payload="${payload_dir}/payload.tar.gz"' in text
    assert "ops/maintenance" in text
    assert "ops/monitoring" in text
    assert "PUBLIC-MAINTENANCE-FALLBACK-RUNBOOK.md" in text
    assert "ServerAliveInterval" in text
    assert "ServerAliveCountMax" in text
    assert "NumberOfPasswordPrompts=0" in text


def test_service_uses_deployed_source_root_and_bounded_oneshot() -> None:
    text = SERVICE.read_text(encoding="utf-8")

    assert "Type=oneshot" in text
    assert "User=wooo" in text
    assert "Group=wooo" in text
    assert "WorkingDirectory=/home/wooo" in text
    assert "Environment=HOME=/home/wooo" in text
    assert "Environment=ROOT_DIR=/home/wooo/awoooi-reboot-recovery-slo" in text
    assert "Environment=TEXTFILE_DIR=/home/wooo/node_exporter_textfiles" in text
    assert "Environment=LOG_DIR=/home/wooo/reboot-recovery" in text
    assert "ExecStart=/usr/local/bin/awoooi-reboot-auto-recovery-slo.sh" in text
    assert "TimeoutStartSec=600" in text


def test_exporter_uses_user_writable_lock_after_creating_log_dir() -> None:
    text = EXPORTER.read_text(encoding="utf-8")

    assert 'LOCK_FILE="${LOCK_FILE:-${LOG_DIR}/reboot_auto_recovery_slo.lock}"' in text
    assert text.index('mkdir -p "$TEXTFILE_DIR" "$LOG_DIR"') < text.index('exec 9>"$LOCK_FILE"')


def test_exporter_carries_stockplatform_readbacks_into_scorecard() -> None:
    text = EXPORTER.read_text(encoding="utf-8")

    assert "STOCK_FRESHNESS_URL" in text
    assert "STOCK_INGESTION_URL" in text
    assert 'stock_freshness_file="$artifact_dir/stock-freshness.json"' in text
    assert 'stock_ingestion_file="$artifact_dir/stock-ingestion.json"' in text
    assert "scorecard_args+=(--stock-freshness-file" in text
    assert "scorecard_args+=(--stock-ingestion-file" in text
    assert "manual_db_update" not in text
    assert "systemctl restart" not in text


def test_exporter_projects_each_scorecard_blocker_to_textfile_metric() -> None:
    text = EXPORTER.read_text(encoding="utf-8")

    assert "active_blocker_metrics" in text
    assert 'for blocker in payload.get("active_blockers") or []' in text
    assert "awoooi_reboot_auto_recovery_slo_active_blocker" in text
    assert "awoooi_reboot_auto_recovery_slo_primary_blocker" in text
    assert 'blocker="{label(blocker)}"' in text
    assert 'target_minutes="{label(target_minutes)}"' in text
