"""Snapshot, install, provider-check, and start operations for v1.1."""

from __future__ import annotations

import json
import os
import shutil
import subprocess
from pathlib import Path

from first_customer_deployment_permission import DeploymentPermission
from first_customer_invite_contract import (
    CANDIDATE,
    HERMES_WHEEL,
    JSON_OBJECT,
    MODULE_SHA256,
    PROFILE_WHEEL,
    ControllerError,
    exclusive_json,
    sha256_file,
)


def deployment_preflight(
    permission: DeploymentPermission,
    receipt: Path,
) -> None:
    exclusive_json(
        receipt,
        {
            "schema": "dualcoach-first-customer-deployment-preflight-v1",
            "status": "PASS_READY",
            "candidate_digest": CANDIDATE,
            "profile": str(permission.profile),
            "target_runtime": str(permission.target_runtime),
            "baseline_unit_sha256": permission.baseline_unit_sha256,
            "mutations": 0,
        },
    )


def _run(command: list[str], *, env: dict[str, str] | None = None) -> str:
    result = subprocess.run(
        command,
        check=False,
        capture_output=True,
        text=True,
        env=env,
    )
    if result.returncode != 0:
        raise ControllerError(
            f"command failed ({result.returncode}): {command[0]}: {result.stderr[-500:]}"
        )
    return result.stdout


def _snapshot(permission: DeploymentPermission) -> None:
    permission.snapshot_root.mkdir(mode=0o700)
    for source in (
        permission.unit_path,
        permission.profile / "config.yaml",
        permission.profile / ".env",
        permission.profile / "customers/registry.json",
        permission.profile / "gateway_state.json",
    ):
        destination = permission.snapshot_root / source.name
        shutil.copy2(source, destination)
        destination.chmod(0o600)


def install_runtime(
    permission: DeploymentPermission,
    receipt: Path,
) -> None:
    unit_switched = False
    _snapshot(permission)
    try:
        permission.target_runtime.mkdir(mode=0o700)
        venv = permission.target_runtime / "venv"
        _run([str(permission.installer_python), "-I", "-m", "venv", str(venv)])
        venv.chmod(0o700)
        wheels = [str(path) for path in sorted(permission.wheelhouse.glob("*.whl"))]
        _run(
            [
                str(venv / "bin/python"),
                "-I",
                "-m",
                "pip",
                "install",
                "--no-index",
                "--no-deps",
                "--no-compile",
                "--no-cache-dir",
                *wheels,
                str(HERMES_WHEEL),
                str(PROFILE_WHEEL),
            ],
            env={
                **os.environ,
                "PIP_CONFIG_FILE": "/dev/null",
                "PIP_NO_INDEX": "1",
                "PYTHONNOUSERSITE": "1",
                "PYTHONDONTWRITEBYTECODE": "1",
            },
        )
        probe = _run(
            [
                str(venv / "bin/python"),
                "-B",
                "-c",
                (
                    "import hashlib,json,pathlib;"
                    "import gateway.platforms.telegram_customer_bootstrap as b;"
                    "p=pathlib.Path(b.__file__);"
                    "print(json.dumps({'module':hashlib.sha256(p.read_bytes()).hexdigest(),"
                    "'ttl':int(b._INVITE_TTL.total_seconds())},sort_keys=True))"
                ),
            ]
        )
        installed = JSON_OBJECT.validate_json(probe)
        if installed != {"module": MODULE_SHA256, "ttl": 86_400}:
            raise ControllerError("installed candidate module mismatch")
        site_packages = venv / "lib/python3.12/site-packages"
        installed_files = [
            path for path in site_packages.rglob("*") if path.is_file()
        ]
        if not installed_files or any(path.stat().st_nlink != 1 for path in installed_files):
            raise ControllerError("installed runtime contains linked package files")
        temporary = permission.unit_path.with_name(
            f".{permission.unit_path.name}.v11.tmp"
        )
        temporary.write_bytes(permission.expected_unit_path.read_bytes())
        temporary.chmod(0o644)
        os.replace(temporary, permission.unit_path)
        unit_switched = True
        _run(["systemctl", "--user", "daemon-reload"])
        exclusive_json(
            receipt,
            {
                "schema": "dualcoach-first-customer-install-receipt-v1",
                "status": "PASS_INSTALLED",
                "candidate_digest": CANDIDATE,
                "target_runtime": str(permission.target_runtime),
                "bootstrap_module_sha256": installed["module"],
                "invite_ttl_seconds": installed["ttl"],
                "venv_mode": "0700",
                "link_mode": "copy",
                "installer": "pip",
                "installed_regular_file_count": len(installed_files),
                "unit_sha256": sha256_file(permission.unit_path),
                "snapshot_root": str(permission.snapshot_root),
            },
        )
    except (ControllerError, OSError, json.JSONDecodeError):
        if unit_switched:
            shutil.copy2(
                permission.snapshot_root / permission.unit_path.name,
                permission.unit_path,
            )
            _run(["systemctl", "--user", "daemon-reload"])
        shutil.rmtree(permission.target_runtime, ignore_errors=True)
        raise


def provider_check(
    permission: DeploymentPermission,
    receipt: Path,
) -> None:
    executable = permission.target_runtime / "venv/bin/dualcoach_admin"
    output = _run(
        [
            str(executable),
            "provider-auth",
            "check",
            "--json",
            "--allow-billable-active-probe",
        ],
        env={
            **os.environ,
            "HERMES_HOME": str(permission.profile),
            "VIRTUAL_ENV": str(permission.target_runtime / "venv"),
            "PATH": f"{permission.target_runtime}/venv/bin:{os.environ['PATH']}",
            "PYTHONDONTWRITEBYTECODE": "1",
        },
    )
    payload = JSON_OBJECT.validate_json(output)
    if payload.get("result") != "ready":
        raise ControllerError("provider readiness probe failed")
    exclusive_json(
        receipt,
        {
            "schema": "dualcoach-first-customer-provider-receipt-v1",
            "status": "PASS_PROVIDER_READY",
            "candidate_digest": CANDIDATE,
            "provider_result": "ready",
            "install_receipt_sha256": sha256_file(
                permission.install_receipt_path
            ),
            "unit_sha256": sha256_file(permission.unit_path),
            "runtime_receipt": payload,
        },
    )


def start_gateway(
    permission: DeploymentPermission,
    receipt: Path,
) -> None:
    _run(["systemctl", "--user", "start", permission.service])
    output = _run(
        [
            "systemctl",
            "--user",
            "show",
            permission.service,
            "-p",
            "MainPID",
            "-p",
            "ActiveState",
            "-p",
            "SubState",
        ]
    )
    values = dict(line.split("=", 1) for line in output.splitlines() if "=" in line)
    if (
        values.get("ActiveState") != "active"
        or values.get("SubState") != "running"
        or not str(values.get("MainPID", "")).isdigit()
        or int(values["MainPID"]) <= 0
    ):
        _run(["systemctl", "--user", "stop", permission.service])
        raise ControllerError("gateway failed to reach active/running")
    exclusive_json(
        receipt,
        {
            "schema": "dualcoach-first-customer-start-receipt-v1",
            "status": "PASS_STARTED",
            "candidate_digest": CANDIDATE,
            "main_pid": int(values["MainPID"]),
        },
    )