from __future__ import annotations

import os
from pathlib import Path

import pytest

os.environ.setdefault(
    "DATABASE_URL",
    "postgresql+asyncpg://test:test@localhost/test",
)

from src.jobs.paid_provider_canary_worker import (  # noqa: E402
    run_paid_provider_canary_worker_once,
)

REPO_ROOT = Path(__file__).resolve().parents[3]


@pytest.mark.asyncio
async def test_worker_is_idle_without_an_approved_run() -> None:
    calls: list[dict] = []

    async def load_none() -> None:
        return None

    async def execute(**kwargs):
        calls.append(kwargs)
        raise AssertionError("executor must not run")

    receipt = await run_paid_provider_canary_worker_once(
        run_loader=load_none,
        executor=execute,
    )

    assert receipt["status"] == "idle_no_approved_run"
    assert receipt["execution_attempted"] is False
    assert calls == []


@pytest.mark.asyncio
async def test_worker_binds_execution_to_the_same_gate5_run() -> None:
    run_id = "019f6c09-e77c-7800-35af-9179358c8f37"
    calls: list[dict] = []

    async def load_run() -> str:
        return run_id

    async def execute(**kwargs):
        calls.append(kwargs)
        return {
            "run_id": run_id,
            "independent_verifier": {"passed": True},
        }

    receipt = await run_paid_provider_canary_worker_once(
        run_loader=load_run,
        executor=execute,
    )

    assert calls == [
        {
            "run_ref": run_id,
            "authorization_ref": run_id,
            "operator_id": "awoooi-paid-provider-canary-worker",
        }
    ]
    assert receipt["status"] == "terminal_verified"
    assert receipt["same_run_authorization"] is True
    assert receipt["independent_verifier_passed"] is True


@pytest.mark.asyncio
async def test_worker_redacts_executor_exception_text() -> None:
    run_id = "019f6c09-e77c-7800-35af-9179358c8f37"
    leaked = "credential-like-provider-error"

    async def load_run() -> str:
        return run_id

    async def execute(**_kwargs):
        raise RuntimeError(leaked)

    receipt = await run_paid_provider_canary_worker_once(
        run_loader=load_run,
        executor=execute,
    )

    assert receipt["status"] == "blocked_with_safe_next_action"
    assert receipt["error_code"] == "executor_RuntimeError"
    assert leaked not in str(receipt)


def test_production_worker_owns_the_paid_canary_executor() -> None:
    manifest = (
        REPO_ROOT / "k8s/awoooi-prod/08-deployment-worker.yaml"
    ).read_text(encoding="utf-8")
    api_manifest = (
        REPO_ROOT / "k8s/awoooi-prod/06-deployment-api.yaml"
    ).read_text(encoding="utf-8")

    assert "ENABLE_PAID_PROVIDER_CANARY_WORKER" in manifest
    assert 'value: "true"' in manifest
    assert "ENABLE_PAID_PROVIDER_CANARY_WORKER" not in api_manifest