from __future__ import annotations

from pathlib import Path

import yaml


REPO_ROOT = Path(__file__).resolve().parents[3]
DEPLOYMENT_PATH = REPO_ROOT / "k8s" / "awoooi-prod" / "06-deployment-api.yaml"


def _api_env() -> dict[str, dict[str, object]]:
    docs = list(yaml.safe_load_all(DEPLOYMENT_PATH.read_text(encoding="utf-8")))
    deployment = next(
        doc
        for doc in docs
        if isinstance(doc, dict)
        and doc.get("kind") == "Deployment"
        and doc.get("metadata", {}).get("name") == "awoooi-api"
    )
    containers = deployment["spec"]["template"]["spec"]["containers"]
    api = next(container for container in containers if container["name"] == "api")
    return {
        item["name"]: item
        for item in api["env"]
        if isinstance(item, dict) and isinstance(item.get("name"), str)
    }


def test_iwooos_wazuh_readonly_live_metadata_enabled_by_gitops_flag_only() -> None:
    env = _api_env()

    assert env["IWOOOS_WAZUH_READONLY_ENABLED"]["value"] == "true"
    assert env["IWOOOS_WAZUH_EXPECTED_MIN_AGENT_COUNT"]["value"] == "6"


def test_iwooos_wazuh_prod_manifest_does_not_inline_secret_values() -> None:
    env = _api_env()

    for name in ("WAZUH_API_BASE_URL", "WAZUH_API_USERNAME", "WAZUH_API_PASSWORD"):
        assert name not in env