#!/usr/bin/env python3
from __future__ import annotations

import importlib.util
import json
import subprocess
import sys
from pathlib import Path


ROOT = Path(__file__).resolve().parents[2]
SCRIPT = ROOT / "ops/runner/verify-awoooi-non110-cd-closure.py"


def _load_module():
    spec = importlib.util.spec_from_file_location(
        "verify_awoooi_non110_cd_closure",
        SCRIPT,
    )
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def _queue(*, no_matching: bool) -> dict:
    return {
        "schema_version": "awoooi_public_gitea_actions_queue_readback_v1",
        "status": (
            "blocked_no_matching_online_runner"
            if no_matching
            else "no_matching_runner_not_visible"
        ),
        "readback": {
            "no_matching_online_runner_visible": no_matching,
            "latest_visible_no_matching_runner_label": (
                "awoooi-non110-ubuntu" if no_matching else ""
            ),
        },
        "operation_boundaries": {
            "workflow_dispatch_performed": False,
            "secret_or_runner_token_read": False,
            "github_api_used": False,
        },
    }


def _workbench(
    *,
    image_current: bool,
    governance_ready: bool,
    runtime_source_current: bool | None = None,
    runtime_image_current: bool | None = None,
) -> dict:
    runtime_source_current = (
        image_current if runtime_source_current is None else runtime_source_current
    )
    runtime_image_current = (
        image_current if runtime_image_current is None else runtime_image_current
    )
    return {
        "schema_version": "delivery_closure_workbench_v1",
        "summary": {
            "source_count": 6,
            "production_deploy_image_tag_matches_main": image_current,
            "production_deploy_runtime_build_matches_committed_source_control_readback": (
                runtime_source_current
            ),
            "production_deploy_runtime_build_matches_committed_production_image_tag": (
                runtime_image_current
            ),
            "production_deploy_runtime_build_readback_status": (
                "matches_committed_deploy_readback"
                if runtime_source_current and runtime_image_current
                else "runtime_build_diverges_from_committed_deploy_readback"
            ),
            "production_deploy_governance_fields_present": governance_ready,
        },
    }


def _deploy_snapshot() -> dict:
    return {
        "schema_version": "awoooi_production_deploy_readback_blocker_v1",
        "readback": {
            "non110_runner_ready": False,
            "non110_runner_ready_config_count": 1,
            "non110_runner_ready_binary_count": 1,
            "non110_runner_ready_registration_count": 0,
            "non110_runner_ready_service_count": 1,
            "non110_runner_ready_active_service_count": 0,
            "non110_runner_ready_autostart_path_count": 1,
            "non110_runner_remaining_blockers": [
                "runner_registration_missing",
                "runner_service_not_active",
            ],
            "non110_runner_safe_next_step": "run_register_awoooi_non110_runner_script_without_printing_token_then_autostart_path_will_enable_service_and_rerun_this_verifier",
        },
    }


def _readiness(*, ready: bool) -> str:
    if ready:
        return "\n".join(
            [
                "raw_runner_registration_read=false",
                "READY_CONFIG_COUNT=1",
                "READY_BINARY_COUNT=1",
                "READY_REGISTRATION_COUNT=1",
                "READY_SERVICE_COUNT=1",
                "READY_ACTIVE_SERVICE_COUNT=1",
                "READY_AUTOSTART_PATH_COUNT=1",
                "AWOOOI_NON110_RUNNER_READY=1",
            ]
        )
    return "\n".join(
        [
            "raw_runner_registration_read=false",
            "BLOCKER runner_registration_missing",
            "BLOCKER runner_service_not_active",
            "READY_CONFIG_COUNT=1",
            "READY_BINARY_COUNT=1",
            "READY_REGISTRATION_COUNT=0",
            "READY_SERVICE_COUNT=1",
            "READY_ACTIVE_SERVICE_COUNT=0",
            "READY_AUTOSTART_PATH_COUNT=1",
            "AWOOOI_NON110_RUNNER_READY=0",
            "safe_next_step=run_register_awoooi_non110_runner_script_without_printing_token_then_autostart_path_will_enable_service_and_rerun_this_verifier",
        ]
    )


def test_closure_verifier_blocks_runner_not_ready_without_secret_leak() -> None:
    module = _load_module()
    payload = module.build_closure_verifier(
        readiness_text=_readiness(ready=False),
        queue=_queue(no_matching=True),
        production_workbench=_workbench(image_current=False, governance_ready=False),
    )
    text = json.dumps(payload, sort_keys=True)
    assert payload["schema_version"] == module.SCHEMA_VERSION
    assert payload["status"] == "blocked_non110_runner_not_ready"
    assert payload["progress"]["ordered_step_count"] == 6
    assert payload["progress"]["ordered_completed_prefix_count"] == 0
    assert payload["progress"]["next_blocked_step_index"] == 1
    assert payload["progress"]["next_blocked_step_id"] == (
        "non110_runner_registration_metadata"
    )
    assert payload["ordered_steps"][0]["status"] == "blocked"
    assert payload["ordered_steps"][0]["evidence_ready"] is False
    assert payload["ordered_steps"][1]["status"] == "pending"
    assert "runner_registration_missing" in payload["runner_readiness_blockers"]
    assert payload["readback"]["non110_runner_ready_registration_count"] == 0
    assert payload["operation_boundaries"]["secret_or_runner_token_read"] is False
    assert payload["operation_boundaries"]["raw_runner_registration_read"] is False
    assert "secret-token-like-content" not in text


def test_closure_verifier_blocks_queue_after_runner_ready() -> None:
    module = _load_module()
    payload = module.build_closure_verifier(
        readiness_text=_readiness(ready=True),
        queue=_queue(no_matching=True),
        production_workbench=_workbench(image_current=False, governance_ready=False),
    )
    assert payload["status"] == "blocked_no_matching_online_runner"
    assert payload["progress"]["ordered_completed_prefix_count"] == 2
    assert payload["progress"]["next_blocked_step_index"] == 3
    assert payload["progress"]["next_blocked_step_id"] == "public_queue_runner_match"
    assert payload["ordered_steps"][0]["status"] == "complete"
    assert payload["ordered_steps"][1]["status"] == "complete"
    assert payload["ordered_steps"][2]["status"] == "blocked"
    assert "public_queue_still_has_no_matching_online_runner" in payload["blockers"]


def test_closure_verifier_uses_deploy_snapshot_when_readiness_file_missing() -> None:
    module = _load_module()
    payload = module.build_closure_verifier(
        readiness_text="",
        queue=_queue(no_matching=True),
        production_workbench=_workbench(image_current=False, governance_ready=False),
        production_deploy_snapshot=_deploy_snapshot(),
    )
    assert payload["status"] == "blocked_non110_runner_not_ready"
    assert payload["readback"]["non110_runner_readiness_source"] == (
        "committed_production_deploy_snapshot"
    )
    assert payload["readback"]["non110_runner_ready_config_count"] == 1
    assert payload["readback"]["non110_runner_ready_registration_count"] == 0
    assert payload["runner_readiness_blockers"] == [
        "runner_registration_missing",
        "runner_service_not_active",
    ]
    assert (
        payload["operation_boundaries"][
            "committed_production_deploy_snapshot_read"
        ]
        is True
    )


def test_closure_verifier_accepts_full_closure_evidence() -> None:
    module = _load_module()
    payload = module.build_closure_verifier(
        readiness_text=_readiness(ready=True),
        queue=_queue(no_matching=False),
        production_workbench=_workbench(image_current=True, governance_ready=True),
    )
    assert payload["status"] == "closure_verified"
    assert payload["progress"]["ordered_completed_prefix_count"] == 6
    assert payload["progress"]["ordered_completion_percent"] == 100
    assert payload["progress"]["next_blocked_step_id"] == ""
    assert all(step["status"] == "complete" for step in payload["ordered_steps"])
    assert payload["blockers"] == []
    assert payload["readback"]["production_deploy_image_tag_matches_main"] is True
    assert (
        payload["readback"][
            "production_deploy_runtime_build_matches_committed_source_control_readback"
        ]
        is True
    )


def test_closure_verifier_blocks_stale_runtime_even_when_desired_tag_matches() -> None:
    module = _load_module()
    payload = module.build_closure_verifier(
        readiness_text=_readiness(ready=True),
        queue=_queue(no_matching=False),
        production_workbench=_workbench(
            image_current=True,
            governance_ready=True,
            runtime_source_current=False,
            runtime_image_current=False,
        ),
    )
    assert payload["status"] == "blocked_production_image_not_current"
    assert payload["progress"]["ordered_completed_prefix_count"] == 4
    assert payload["progress"]["next_blocked_step_id"] == "production_image_tag_current"
    assert "production_image_tag_not_current" in payload["blockers"]
    assert payload["readback"]["production_deploy_image_tag_matches_main"] is False
    assert (
        payload["readback"][
            "production_deploy_runtime_build_matches_committed_source_control_readback"
        ]
        is False
    )


def test_cli_uses_fixture_files_without_live_dispatch(tmp_path: Path) -> None:
    readiness_path = tmp_path / "readiness.txt"
    queue_path = tmp_path / "queue.json"
    workbench_path = tmp_path / "workbench.json"
    readiness_path.write_text(_readiness(ready=False), encoding="utf-8")
    queue_path.write_text(json.dumps(_queue(no_matching=True)), encoding="utf-8")
    workbench_path.write_text(
        json.dumps(_workbench(image_current=False, governance_ready=False)),
        encoding="utf-8",
    )

    result = subprocess.run(
        [
            sys.executable,
            str(SCRIPT),
            "--readiness-file",
            str(readiness_path),
            "--queue-json-file",
            str(queue_path),
            "--production-workbench-json-file",
            str(workbench_path),
            "--json",
        ],
        check=False,
        text=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
    )

    assert result.returncode == 1
    payload = json.loads(result.stdout)
    assert payload["status"] == "blocked_non110_runner_not_ready"
    assert payload["operation_boundaries"]["workflow_dispatch_performed"] is False
    assert payload["operation_boundaries"]["github_api_used"] is False


def test_cli_uses_deploy_snapshot_without_readiness_file(tmp_path: Path) -> None:
    queue_path = tmp_path / "queue.json"
    snapshot_path = tmp_path / "deploy-snapshot.json"
    workbench_path = tmp_path / "workbench.json"
    queue_path.write_text(json.dumps(_queue(no_matching=True)), encoding="utf-8")
    snapshot_path.write_text(json.dumps(_deploy_snapshot()), encoding="utf-8")
    workbench_path.write_text(
        json.dumps(_workbench(image_current=False, governance_ready=False)),
        encoding="utf-8",
    )

    result = subprocess.run(
        [
            sys.executable,
            str(SCRIPT),
            "--production-deploy-snapshot-json-file",
            str(snapshot_path),
            "--queue-json-file",
            str(queue_path),
            "--production-workbench-json-file",
            str(workbench_path),
            "--json",
        ],
        check=False,
        text=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
    )

    assert result.returncode == 1
    payload = json.loads(result.stdout)
    assert payload["status"] == "blocked_non110_runner_not_ready"
    assert payload["readback"]["non110_runner_readiness_source"] == (
        "committed_production_deploy_snapshot"
    )
    assert payload["operation_boundaries"]["raw_runner_registration_read"] is False