from __future__ import annotations

import hashlib
import os
from pathlib import Path

import pytest
from checkin_cli.weekly_operations_store import WeeklyOperationsStore

from nutricoach_continuity.contract import SOURCE_FILE_DIGEST, SOURCE_ROW_DIGEST
from nutricoach_continuity.permission import PermissionPackageError, load_permission
from nutricoach_continuity.production import (
    DurableReceiptWriter,
    InstalledRowExecutor,
    open_installed_authority,
)
from nutricoach_continuity.sealer import seal
from nutricoach_continuity.verifier import ExactInputVerifier

from .real_support import build_permission, customer

pytestmark = pytest.mark.skipif(
    "NUTRICOACH_TEST_CUSTOMER_KEY_FILE" not in os.environ,
    reason="private installed-store customer fixture is unavailable",
)


def test_real_installed_store_reissues_exact_row_and_persists_provenance(tmp_path: Path) -> None:
    package = build_permission(tmp_path)
    package.contract.authorization_root.mkdir(mode=0o700)
    package.contract.execution_root.mkdir(mode=0o700)
    executor = InstalledRowExecutor(package.contract, package.runtime.customer_key_file)
    receipts = DurableReceiptWriter(package.contract.execution_root, package.contract)
    receipts.write_intent("b" * 64)
    executor.append()
    receipts.write_provenance()
    target = open_installed_authority(package.contract.target_root.path)
    try:
        rows = WeeklyOperationsStore.for_authority(target, customer()).read()
    finally:
        target.close()
    provenance = package.contract.execution_root / "provenance-receipt.json"
    assert len(rows) == 1
    assert rows[0].row_digest == SOURCE_ROW_DIGEST
    assert (
        hashlib.sha256(
            next(package.contract.target_root.path.glob("*.day-status-v1.jsonl")).read_bytes()
        ).hexdigest()
        == SOURCE_FILE_DIGEST
    )
    assert provenance.is_file()
    assert SOURCE_ROW_DIGEST.encode() in provenance.read_bytes()


def test_permission_seal_round_trip_and_tamper_rejection(tmp_path: Path) -> None:
    package = build_permission(tmp_path / "fixture")
    permission, preseal = tmp_path / "permission", tmp_path / "preseal"
    phrase = seal(package, permission, preseal)
    assert load_permission(permission) == package
    assert phrase.endswith(package.package_digest)
    path = permission / "package.json"
    path.chmod(0o600)
    _ = path.write_bytes(path.read_bytes().replace(b"continuity-v1", b"continuity-v2"))
    path.chmod(0o400)
    with pytest.raises(PermissionPackageError):
        _ = load_permission(permission)


def test_foreign_root_and_root_inode_drift_fail_before_append(tmp_path: Path) -> None:
    package = build_permission(tmp_path)
    wrong = package.contract.model_copy(
        update={"target_root": package.contract.target_root.model_copy(update={"inode": 1})}
    )
    with pytest.raises(RuntimeError, match="root identity"):
        ExactInputVerifier().verify(wrong)
    target = open_installed_authority(package.contract.target_root.path)
    try:
        assert WeeklyOperationsStore.for_authority(target, customer()).read() == ()
    finally:
        target.close()