from __future__ import annotations

from pathlib import Path
from urllib.parse import urlparse

import yaml

ROOT = Path(__file__).resolve().parents[3]
EXPECTED_ORDER = {
    "OLLAMA_URL": "http://34.143.170.20:11434",
    "OLLAMA_SECONDARY_URL": "http://34.21.145.224:11434",
    "OLLAMA_FALLBACK_URL": "http://192.168.0.111:11434",
}


def _load_single_doc(path: Path) -> dict:
    docs = [doc for doc in yaml.safe_load_all(path.read_text()) if doc]
    assert docs, f"no YAML documents in {path}"
    return docs[0]


def _load_named_doc(path: Path, *, name: str) -> dict:
    docs = [doc for doc in yaml.safe_load_all(path.read_text()) if doc]
    return next(doc for doc in docs if doc["metadata"]["name"] == name)


def test_prod_configmap_preserves_ollama_policy_order() -> None:
    configmap = _load_single_doc(ROOT / "k8s/awoooi-prod/04-configmap.yaml")

    assert configmap["data"] | EXPECTED_ORDER == configmap["data"]
    assert {configmap["data"][key] for key in EXPECTED_ORDER} == set(EXPECTED_ORDER.values())


def test_prod_deployment_preserves_ollama_policy_order() -> None:
    deployment = _load_single_doc(ROOT / "k8s/awoooi-prod/06-deployment-api.yaml")
    env = {
        item["name"]: item.get("value")
        for item in deployment["spec"]["template"]["spec"]["containers"][0]["env"]
    }

    assert {key: env[key] for key in EXPECTED_ORDER} == EXPECTED_ORDER
    assert {env[key] for key in EXPECTED_ORDER} == set(EXPECTED_ORDER.values())


def test_retired_host110_ollama_proxy_is_absent_from_runtime_manifests() -> None:
    for relative in (
        "k8s/awoooi-prod/04-configmap.yaml",
        "k8s/awoooi-prod/06-deployment-api.yaml",
        "k8s/awoooi-dev/02-configmap.yaml",
    ):
        text = (ROOT / relative).read_text(encoding="utf-8")
        assert "192.168.0.110:11435" not in text
        assert "192.168.0.110:11436" not in text
        assert "192.168.0.110:11437" not in text


def test_prod_network_policy_allows_only_canonical_ollama_egress() -> None:
    policy = _load_named_doc(
        ROOT / "k8s/awoooi-prod/02-network-policy.yaml",
        name="allow-required-egress",
    )
    ollama_rules = [
        rule
        for rule in policy["spec"]["egress"]
        if any(int(port["port"]) == 11434 for port in rule.get("ports", []))
    ]

    assert len(ollama_rules) == 1
    assert ollama_rules[0]["ports"] == [{"protocol": "TCP", "port": 11434}]
    assert {
        target["ipBlock"]["cidr"] for target in ollama_rules[0]["to"]
    } == {
        f"{urlparse(url).hostname}/32" for url in EXPECTED_ORDER.values()
    }

    host110_rules = [
        rule
        for rule in policy["spec"]["egress"]
        if any(
            target.get("ipBlock", {}).get("cidr") == "192.168.0.110/32"
            for target in rule.get("to", [])
        )
    ]
    assert host110_rules
    assert {11434, 11435, 11436, 11437}.isdisjoint(
        {
            int(port["port"])
            for rule in host110_rules
            for port in rule.get("ports", [])
        }
    )


def test_host111_allowlist_admits_k3s_direct_and_retires_host110_transport() -> None:
    playbook = (
        ROOT / "infra/ansible/playbooks/111-ollama-fallback.yml"
    ).read_text(encoding="utf-8")
    assert "192.168.0.120/32" in playbook
    assert "192.168.0.121/32" in playbook
    assert "192.168.0.110/32" not in playbook

    retired_deployer = (
        ROOT / "ops/nginx/deploy-ollama-proxy-110.sh"
    ).read_text(encoding="utf-8")
    assert "exit 78" in retired_deployer
    assert "NGINX_CONF=" not in retired_deployer
    assert "proxy_pass" not in retired_deployer


def test_nginx_catalog_cannot_recreate_retired_host110_ollama_transport() -> None:
    for relative in (
        "infra/ansible/playbooks/nginx-sync.yml",
        "infra/ansible/playbooks/nginx-sync-readonly.yml",
    ):
        text = (ROOT / relative).read_text(encoding="utf-8")
        assert "hosts: host_110" not in text
        assert "110-ollama-proxy.conf" not in text
        assert "11435" not in text
        assert "11436" not in text
        assert "11437" not in text

    assert not (
        ROOT / "infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2"
    ).exists()