from __future__ import annotations

import hashlib
import json
import os
import stat
import subprocess
from functools import lru_cache
from pathlib import Path


ROOT = Path(__file__).resolve().parent
CONTROLLER = ROOT / "first_customer_deployment_controller.py"
OPERATIONS = ROOT / "first_customer_deployment_operations.py"
PERMISSION_MODULE = ROOT / "first_customer_deployment_permission.py"
APPROVAL = ROOT / "approval-event.json"
AUTHORIZATION = ROOT / "launch-authorization.json"
PYTHON = Path("/home/cube/projects/richard/hermes-agent/.venv/bin/python")
INSTALLER_PYTHON = Path("/home/cube/miniconda3/bin/python3.12")
WHEELHOUSE = Path(
    "/home/cube/projects/richard/traning coach/.omo/evidence/task26/"
    "task26-combined-v38-delivered-st_01a019d7/wheelhouse"
)
RELEASE = Path(
    "/home/cube/projects/richard/traning coach/.omo/evidence/releases/dualcoach-v1.1.0"
)


def _sha(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


@lru_cache(maxsize=1)
def _wheelhouse_digest() -> str:
    rows = [
        {"name": path.name, "sha256": _sha(path), "size": path.stat().st_size}
        for path in sorted(WHEELHOUSE.glob("*.whl"))
    ]
    raw = json.dumps(rows, sort_keys=True, separators=(",", ":")).encode()
    return hashlib.sha256(raw).hexdigest()


def _write_json(path: Path, value: dict[str, object]) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(value, sort_keys=True, separators=(",", ":")))
    path.chmod(0o600)


def _fixture(tmp_path: Path) -> tuple[Path, Path, dict[str, Path], dict[str, str]]:
    profile = tmp_path / "profile"
    for path in (
        profile,
        profile / "data",
        profile / "customers",
        profile / "data/customers",
        profile / ".strict-runtime",
    ):
        path.mkdir(mode=0o700)
    _write_json(
        profile / "customers/registry.json",
        {
            "version": 1,
            "customers": [
                {
                    "enabled": False,
                    "ai_processing_consent": {"granted": False},
                }
            ],
        },
    )
    for name, value in (
        ("config.yaml", "platforms: {}\n"),
        (".env", "TOKEN=redacted\n"),
        ("gateway_state.json", '{"gateway_state":"stopped"}\n'),
    ):
        path = profile / name
        path.write_text(value)
        path.chmod(0o600)
    target = profile / ".strict-runtime/0e383539-v11"
    unit = tmp_path / "gateway.service"
    unit.write_text(
        "ExecStart=/old/runtime/python -m hermes_cli.main "
        "--profile dualcoachtest gateway run\n"
    )
    unit.chmod(0o600)
    expected_unit = tmp_path / "expected-gateway.service"
    expected_unit.write_text(
        f"ExecStart={target}/venv/bin/python -m hermes_cli.main "
        "--profile dualcoachtest gateway run\n"
    )
    expected_unit.chmod(0o600)
    fake_bin = tmp_path / "bin"
    fake_bin.mkdir()
    systemctl = fake_bin / "systemctl"
    systemctl.write_text(
        "#!/bin/sh\n"
        "case \"$*\" in\n"
        "  *show*) printf 'MainPID=0\\nActiveState=inactive\\nSubState=dead\\n' ;;\n"
        "  *) exit 0 ;;\n"
        "esac\n"
    )
    systemctl.chmod(0o700)
    paths = {
        "target": target,
        "unit": unit,
        "expected_unit": expected_unit,
        "snapshot": tmp_path / "snapshot",
        "preflight": tmp_path / "deploy-preflight.json",
        "install": tmp_path / "install.json",
        "provider": tmp_path / "provider.json",
        "start": tmp_path / "start.json",
    }
    permission = tmp_path / "deployment-permission.json"
    _write_json(
        permission,
        {
            "schema": "dualcoach-first-customer-deployment-permission-v1",
            "candidate_digest": "0e383539aea1b83205771772f1e8b417840defe60f5ea6ce184f80e3af8d25f9",
            "hermes_wheel_sha256": "ec160d3d0e29bc747f463923d31bfe736aefb5840a3d32fcb04842aa5139ddb0",
            "profile_wheel_sha256": "a56da2417df0912f3fe407c0b78befd7362207d1c8a35271000af46701ba79d2",
            "profile": str(profile),
            "service": "hermes-gateway-dualcoachtest.service",
            "installer_python": str(INSTALLER_PYTHON),
            "installer_python_sha256": _sha(INSTALLER_PYTHON),
            "wheelhouse": str(WHEELHOUSE),
            "wheelhouse_count": 107,
            "wheelhouse_inventory_sha256": _wheelhouse_digest(),
            "target_runtime": str(target),
            "unit_path": str(unit),
            "baseline_unit_sha256": _sha(unit),
            "expected_unit_path": str(expected_unit),
            "expected_unit_sha256": _sha(expected_unit),
            "snapshot_root": str(paths["snapshot"]),
            "preflight_receipt_path": str(paths["preflight"]),
            "install_receipt_path": str(paths["install"]),
            "provider_receipt_path": str(paths["provider"]),
            "start_receipt_path": str(paths["start"]),
            "approval_event_path": str(APPROVAL),
            "approval_event_sha256": _sha(APPROVAL),
            "launch_authorization_path": str(AUTHORIZATION),
            "launch_authorization_sha256": _sha(AUTHORIZATION),
            "controller_sha256": _sha(CONTROLLER) if CONTROLLER.exists() else "0" * 64,
            "operations_sha256": _sha(OPERATIONS) if OPERATIONS.exists() else "0" * 64,
            "permission_module_sha256": _sha(PERMISSION_MODULE)
            if PERMISSION_MODULE.exists()
            else "0" * 64,
            "allowed_modes": ["preflight", "install", "provider-check", "start"],
        },
    )
    env = {
        **os.environ,
        "PATH": f"{fake_bin}:{os.environ['PATH']}",
        "PYTHONPATH": str(ROOT),
        "PYTHONDONTWRITEBYTECODE": "1",
    }
    return profile, permission, paths, env


def _run(
    mode: str,
    profile: Path,
    permission: Path,
    receipt: Path,
    env: dict[str, str],
) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [
            str(PYTHON),
            "-B",
            str(CONTROLLER),
            mode,
            "--profile",
            str(profile),
            "--permission",
            str(permission),
            "--receipt",
            str(receipt),
        ],
        check=False,
        capture_output=True,
        text=True,
        env=env,
    )


def test_deployment_preflight_is_read_only_and_authorized(tmp_path: Path) -> None:
    profile, permission, paths, env = _fixture(tmp_path)

    result = _run("preflight", profile, permission, paths["preflight"], env)

    assert result.returncode == 0, result.stderr
    assert json.loads(paths["preflight"].read_text())["status"] == "PASS_READY"
    assert not paths["target"].exists()
    assert not paths["snapshot"].exists()


def test_install_builds_exact_parallel_runtime_and_switches_unit(
    tmp_path: Path,
) -> None:
    profile, permission, paths, env = _fixture(tmp_path)
    preflight = _run("preflight", profile, permission, paths["preflight"], env)
    assert preflight.returncode == 0, preflight.stderr

    result = _run("install", profile, permission, paths["install"], env)

    assert result.returncode == 0, result.stderr
    receipt = json.loads(paths["install"].read_text())
    assert receipt["status"] == "PASS_INSTALLED"
    assert receipt["bootstrap_module_sha256"] == (
        "777e8ed7932d7834f39a67c8f8001742df99746ea4a990a5cedbc003fa51ab23"
    )
    assert receipt["invite_ttl_seconds"] == 86_400
    assert receipt["link_mode"] == "copy"
    assert receipt["installer"] == "pip"
    assert receipt["installed_regular_file_count"] > 0
    assert paths["unit"].read_bytes() == paths["expected_unit"].read_bytes()
    assert (paths["target"] / "venv/bin/python").is_file()
    assert stat.S_IMODE((paths["target"] / "venv").stat().st_mode) == 0o700
    records = list((paths["target"] / "venv").glob("lib/python3.12/site-packages/*.dist-info/RECORD"))
    assert records
    assert all(path.stat().st_nlink == 1 for path in records)
    assert (paths["snapshot"] / "gateway.service").is_file()
    golden = subprocess.run(
        [
            str(paths["target"] / "venv/bin/python"),
            "-B",
            "-c",
            (
                "import importlib.util,json,pathlib,sysconfig;"
                f"b=pathlib.Path({str(RELEASE)!r});"
                "h=b/'installed-golden-bundle/verification-tools/"
                "installed_wheel_provenance.py';"
                "s=importlib.util.spec_from_file_location('sealed',h);"
                "m=importlib.util.module_from_spec(s);s.loader.exec_module(m);"
                f"v=pathlib.Path({str(paths['target'] / 'venv')!r});"
                "r=m.collect_installed_runtime("
                "venv=v,site_packages=pathlib.Path(sysconfig.get_paths()['purelib']),"
                "hermes_wheel=b/'artifacts/hermes_agent-0.17.0-py3-none-any.whl',"
                "profile_wheel=b/'artifacts/physique_checkin_cli-0.1.0-py3-none-any.whl');"
                "a=m.portable_installed_runtime(r);"
                "g=json.loads((b/'installed-golden-bundle/installed-provenance.json')"
                ".read_text())['binding']['runtime_portable'];"
                "assert a==g;print('INSTALLED_BYTES_MATCH_SEALED_GOLDEN')"
            ),
        ],
        check=False,
        capture_output=True,
        text=True,
    )
    assert golden.returncode == 0, golden.stderr


def test_wrong_owner_authorization_fails_before_snapshot(tmp_path: Path) -> None:
    profile, permission, paths, env = _fixture(tmp_path)
    value = json.loads(permission.read_text())
    value["approval_event_sha256"] = "f" * 64
    _write_json(permission, value)

    result = _run("install", profile, permission, paths["install"], env)

    assert result.returncode == 2
    assert not paths["target"].exists()
    assert not paths["snapshot"].exists()


def test_provider_check_requires_successful_install(tmp_path: Path) -> None:
    profile, permission, paths, env = _fixture(tmp_path)

    result = _run("provider-check", profile, permission, paths["provider"], env)

    assert result.returncode == 2
    assert not paths["provider"].exists()


def test_provider_check_rejects_zero_installed_file_counter(tmp_path: Path) -> None:
    profile, permission, paths, env = _fixture(tmp_path)
    preflight = _run("preflight", profile, permission, paths["preflight"], env)
    assert preflight.returncode == 0, preflight.stderr
    installed = _run("install", profile, permission, paths["install"], env)
    assert installed.returncode == 0, installed.stderr
    receipt = json.loads(paths["install"].read_text())
    receipt["installed_regular_file_count"] = 0
    _write_json(paths["install"], receipt)

    result = _run("provider-check", profile, permission, paths["provider"], env)

    assert result.returncode == 2
    assert not paths["provider"].exists()


def test_start_requires_bound_provider_receipt_and_reaches_running(
    tmp_path: Path,
) -> None:
    profile, permission, paths, env = _fixture(tmp_path)
    preflight = _run("preflight", profile, permission, paths["preflight"], env)
    assert preflight.returncode == 0, preflight.stderr
    installed = _run("install", profile, permission, paths["install"], env)
    assert installed.returncode == 0, installed.stderr
    _write_json(
        paths["provider"],
        {
            "schema": "dualcoach-first-customer-provider-receipt-v1",
            "status": "PASS_PROVIDER_READY",
            "candidate_digest": (
                "0e383539aea1b83205771772f1e8b417840defe60f5ea6ce184f80e3af8d25f9"
            ),
            "install_receipt_sha256": _sha(paths["install"]),
            "unit_sha256": _sha(paths["unit"]),
        },
    )
    systemctl = Path(env["PATH"].split(":", 1)[0]) / "systemctl"
    systemctl.write_text(
        "#!/bin/sh\n"
        "case \"$*\" in\n"
        "  *show*) printf 'MainPID=123\\nActiveState=active\\nSubState=running\\n' ;;\n"
        "  *) exit 0 ;;\n"
        "esac\n"
    )
    systemctl.chmod(0o700)

    result = _run("start", profile, permission, paths["start"], env)

    assert result.returncode == 0, result.stderr
    assert json.loads(paths["start"].read_text())["status"] == "PASS_STARTED"