"""Source contracts for production deploy provenance and health semantics."""

from __future__ import annotations

from pathlib import Path

import yaml

REPO_ROOT = Path(__file__).resolve().parents[3]


def _read(path: str) -> str:
    return (REPO_ROOT / path).read_text()


def test_low_level_ec2_deploy_is_not_directly_dispatchable() -> None:
    workflow = _read(".github/workflows/deploy-ec2.yml")
    assert "workflow_call:" in workflow
    assert "workflow_dispatch:" not in workflow
    assert "environment: production" in workflow


def test_deploy_requires_main_ancestor_and_matching_immutable_image() -> None:
    workflow = _read(".github/workflows/deploy-ec2.yml")
    assert "git merge-base --is-ancestor" in workflow
    assert 'EXPECTED_TAG="sha-${RESOLVED_SHA}"' in workflow
    assert '"$IMAGE_TAG" != "$EXPECTED_TAG"' in workflow


def test_every_production_probe_uses_dependency_aware_readiness() -> None:
    assert 'path                = "/api/v1/ready"' in _read(
        "infra/aws/modules/alb/main.tf",
    )
    assert "/api/v1/ready" in _read("deploy/compose/docker-compose.prod.yml")
    healthcheck = _read("deploy/scripts/healthcheck.sh")
    assert '"http://localhost:8000/api/v1/ready"' in healthcheck
    assert '"http://localhost:8000/api/v1/health"' not in healthcheck


def test_dax_integration_personal_gate_requires_an_explicit_preserve_or_boolean_input() -> None:
    workflow = _read(".github/workflows/deploy-dax-bigquery-integration.yml")
    helper = _read("deploy/scripts/upsert-dax-bigquery-integration.sh")
    upsert = _read("server/scripts/upsert_data_access_bigquery_integration.py")

    assert "personal_apply_enabled:" in workflow
    assert 'default: "preserve"' in workflow
    assert "INPUT_PERSONAL_APPLY_ENABLED" in workflow
    assert "HELIX_DAX_BIGQUERY_PERSONAL_APPLY_ENABLED" in workflow
    assert "HELIX_DAX_BIGQUERY_PERSONAL_APPLY_ENABLED" in helper
    assert '--personal-apply-enabled "${PERSONAL_APPLY_ENABLED}"' in helper
    assert '"--personal-apply-enabled"' in upsert
    assert "personal_apply_enabled=_personal_apply_value(" in upsert


def test_worker_probe_is_real_and_required_before_release_is_green() -> None:
    compose = _read("deploy/compose/docker-compose.prod.yml")
    assert "/tmp/helix-worker-heartbeat" in compose
    assert "sys.exit(0)" not in compose

    healthcheck = _read("deploy/scripts/healthcheck.sh")
    assert 'check_container_health "Worker scheduler" "worker"' in healthcheck
    assert "docker inspect" in healthcheck


def test_successful_rollback_does_not_turn_failed_release_green() -> None:
    deploy = _read("deploy/scripts/deploy.sh")
    rollback_call = deploy.index('"$SCRIPT_DIR/rollback.sh" "$PREVIOUS_TAG"')
    nonzero_exit = deploy.index("exit 2", rollback_call)
    assert nonzero_exit > rollback_call


def test_staging_deploy_is_on_demand_only_and_disabled_until_bootstrap() -> None:
    workflow = _read(".github/workflows/staging-deploy.yml")
    config = yaml.load(workflow, Loader=yaml.BaseLoader)

    # No `schedule:` (removed 2026-09-06). A run fails closed unless Staging is
    # already at the release's Alembic head, and main lands migrations every
    # working day, so a daily trigger could only ever be red. Re-adding one
    # requires first deciding whether an unattended run may migrate and
    # re-attest Staging itself — a safety-boundary change, not a cron change.
    assert set(config["on"]) == {"workflow_dispatch"}
    assert config["permissions"] == {}
    assert config["concurrency"]["group"] == "helix-staging-deploy"
    assert config["concurrency"]["cancel-in-progress"] == "false"

    jobs = config["jobs"]
    assert "HELIX_STAGING_AUTO_DEPLOY_ENABLED != 'true'" in jobs["disabled"]["if"]
    assert jobs["deploy"]["environment"] == "staging"
    assert "HELIX_STAGING_AUTO_DEPLOY_ENABLED == 'true'" in jobs["deploy"]["if"]
    assert jobs["deploy"]["permissions"] == {
        "checks": "read",
        "contents": "read",
        "id-token": "write",
    }


def test_staging_deploy_binds_exact_main_ci_and_digests_without_production_path() -> None:
    workflow = _read(".github/workflows/staging-deploy.yml")

    assert 'select(.name == "go-ci / Main" and .app.slug == "github-actions")' in workflow
    assert "compare/${release_sha}...main" in workflow
    assert 'GITHUB_REF" != "refs/heads/main' in workflow
    assert "ALICLOUD_STAGING_DEPLOY_ROLE_ARN" in workflow
    assert "sts.aliyuncs.com" in workflow
    assert "aliyun configure set --mode OIDC" in workflow
    assert '--oidc-token-file "$ALICLOUD_STAGING_OIDC_TOKEN_FILE"' in workflow
    assert "Refresh short-lived Alibaba Cloud OIDC token" in workflow
    assert "ALICLOUD_STAGING_OSS_BUCKET" in workflow
    assert "x-oss-forbid-overwrite:true" in workflow
    assert "x-oss-server-side-encryption:AES256" in workflow
    assert "helix-staging/blobs/sha256/" in workflow
    assert "Validate automatic DAX lineage-root projection" in workflow
    assert "Publish content-addressed DAX inventory" in workflow
    assert "helix-staging/catalogs/sha256/" in workflow
    assert "dax_inventory_key" in workflow
    assert "dax_inventory_sha" in workflow
    assert "RunCommand" in workflow
    assert "--KeepCommand false" in workflow
    assert "\"$exit_code\" == '42'" in workflow
    assert "reserved migration-only phase" in workflow
    assert "steps.deploy.outputs.migration_only != 'true'" in workflow
    assert "Record migration-only completion" in workflow
    assert "compose_b64" in workflow
    assert "path: .staging-control" in workflow
    assert ".staging-control/deploy/staging/deploy-on-ecs.sh" in workflow
    assert "deploy-ec2.yml" not in workflow
    assert "image-release.yml" not in workflow
    assert "AWS_" not in workflow
    assert "STAGING_ACR" not in workflow
    assert "/api/v1/ready" in workflow


def test_staging_host_contract_is_backend_frontend_only_and_fails_closed() -> None:
    host = _read("deploy/staging/deploy-on-ecs.sh")
    compose = _read("deploy/staging/docker-compose.staging.yml")

    assert 'require_mode_600 "$RUNTIME_ENV"' in host
    assert "STAGING_OSS_REGION" in host
    assert "COMPOSE_B64" in host
    assert "DAX_INVENTORY_KEY" in host
    assert "DAX_INVENTORY_SHA" in host
    assert "helix-staging/catalogs/sha256/" in host
    assert "base64 --decode" in host
    assert "STAGING_DOCKER_NETWORK" in host
    assert "STAGING_REDIS_VOLUME" in host
    assert "STAGING_SANITIZATION_RECEIPT" in host
    assert host.count("PYTHONPATH=/app") == 6
    assert "require_sanitization_receipt" in host
    assert "staging-dax-retained-*.json" in host
    assert 'receipt_type == "dax_retained_validation"' in host
    assert 'retention_policy == "preserve_across_deploys"' in host
    assert ".metadata_only_credential == true" in host
    assert ".apply_mode_enabled == false" in host
    assert ".personal_apply_enabled == false" in host
    assert ".service_account_apply_enabled == false" in host
    assert ".cleanup_required_before_next_deploy == false" in host
    assert "provider_credentials_removed == true" in host
    assert "people_pseudonymized == true" in host
    assert "sanitization_revision" in host
    assert '"$sanitization_revision" == "$schema_current"' in host
    assert "re-sanitize or re-attest schema" in host
    assert "migration_complete_revalidation_required" in host
    assert "runtime_replaced:false" in host
    assert "MIGRATION_ONLY_EXIT_CODE=42" in host
    assert 'exit "$MIGRATION_ONLY_EXIT_CODE"' in host
    assert "normalize_unexpected_error" in host
    assert "docker network inspect" in host
    assert "docker volume inspect" in host
    assert "--mode EcsRamRole" in host
    assert "STAGING_ECS_RAM_ROLE" in host
    assert "sha256sum --check --strict" in host
    assert "scripts/seed_data_access_resources.py" in host
    assert "--lineage-catalog" in host
    assert "grep -q -- '--lineage-catalog'" in host
    assert "lineage_evidence_prefix" in host
    assert "--commit" in host
    assert "staging-release-${RELEASE_SHA}" in host
    assert "--unresolved-owner-fallback-email" in host
    assert "xiaopeng.zhu@pingcap.com" in host
    assert "zstd -dc" in host
    assert 'docker image inspect "$SERVER_IMAGE" | jq' in host
    assert "this run is not authorized to migrate" in host
    assert "runtime-only rollback" in host
    assert "backend frontend redis" in host
    assert "worker" not in compose
    assert set(yaml.safe_load(compose)["services"]) == {"backend", "frontend", "redis"}
    assert "redis:7.4.2-alpine@sha256:" in compose
    assert "condition: service_healthy" in compose
    assert "external: true" in compose


def test_staging_failures_are_legible_and_classified_not_raw_base64() -> None:
    """Every Staging failure used to reach the log as an undecoded Base64 blob.

    Nobody could tell an authorized-migration precondition apart from a broken
    deploy without hand-decoding it, so 13 consecutive nightly failures went
    unactioned. The log must decode the host output and must name which of the
    two states it is.
    """
    workflow = _read(".github/workflows/staging-deploy.yml")
    host = _read("deploy/staging/deploy-on-ecs.sh")

    # The Cloud Assistant Output is Base64; it is decoded before it is printed.
    assert "decoded_output()" in workflow
    assert "base64 -d" in workflow
    assert 'command_output="$(decoded_output ' in workflow

    # Schema drift is a standing precondition with its own reserved exit code,
    # reported without parsing human-readable output (same shape as 42).
    assert "MIGRATION_REQUIRED_EXIT_CODE=43" in host
    assert 'exit "$MIGRATION_REQUIRED_EXIT_CODE"' in host
    assert "SCHEMA_BEHIND current=${schema_current} head=${schema_head}" in host
    assert "\"$exit_code\" == '43'" in workflow
    assert "Staging awaits an authorized migration" in workflow
    assert "SCHEMA_BEHIND current=" in workflow
    assert "apply_migrations=true" in workflow

    # A red main is the ancestor gate working, not a Staging defect; say so.
    assert "main is not verified" in workflow
    assert "Staging refused to deploy an unverified" in workflow


def test_staging_reattestation_cannot_advance_a_migrated_revision() -> None:
    """The retained-DAX helper copies the source receipt's `database` block, so
    it can never attest a schema the sanitizer did not see. After a migration it
    must refuse and name the only real continuation: re-run the sanitizer."""
    script = _read("deploy/staging/reattest-dax-retained-on-ecs.sh")

    assert '[[ "$source_revision" == "$schema_current" ]] || {' in script
    assert "Re-attestation cannot advance a revision" in script
    assert "re-run the Staging Branch sanitizer" in script
    assert "database: $source[0].database" in script


def test_staging_retained_dax_receipt_is_live_reattested_and_immutable() -> None:
    script = _read("deploy/staging/reattest-dax-retained-on-ecs.sh")

    assert "HELIX_STAGING_DAX_RECEIPT_ID" in script
    assert '[[ ! -e "$OUTPUT_RECEIPT" ]]' in script
    assert "backend frontend redis" in script
    assert "secrets_encrypted IS NOT NULL" in script
    assert "apply_mode_enabled" in script
    assert "personal_apply_enabled" in script
    assert "service_account_apply_enabled" in script
    assert "scheduled_jobs WHERE enabled = 1" in script
    assert "identity_sync_targets WHERE enabled = 1" in script
    assert 'receipt_type: "dax_retained_validation"' in script
    assert 'retention_policy: "preserve_across_deploys"' in script
    assert "cleanup_required_before_next_deploy: false" in script
    assert "provider_credentials_removed: false" in script
    assert "provider_locators_removed: false" in script


def test_production_catalog_seed_derives_referenced_sources_automatically() -> None:
    workflow = _read(".github/workflows/seed-dax-dataset-catalog.yml")
    helper = _read("deploy/scripts/seed-dax-dataset-catalog.sh")

    assert "sync_data_access_lineage_roots.py" in workflow
    assert "lineage_catalog_path" in workflow
    assert "LINEAGE_CATALOG_KEY" in workflow
    assert "HELIX_DAX_LINEAGE_CATALOG_PATH" in workflow
    assert "HELIX_DAX_LINEAGE_CATALOG_PATH" in helper
    assert "--lineage-catalog" not in helper
    assert "grep -q -- '--lineage-catalog'" not in helper
    assert "using preassembled workflow inventory" in helper


def test_production_catalog_seed_reconciles_reviewed_main_artifacts_daily() -> None:
    workflow = _read(".github/workflows/seed-dax-dataset-catalog.yml")
    config = yaml.load(workflow, Loader=yaml.BaseLoader)

    schedules = config["on"]["schedule"]
    assert schedules == [{"cron": "20 6 * * *", "timezone": "Asia/Shanghai"}]
    assert "github.event_name == 'schedule'" in workflow
    assert "INPUT_DRY_RUN" in workflow
    assert "env.INPUT_DRY_RUN == 'false'" in workflow
    assert "bigquery.datasets.list" not in _read("infra/gcp-dax/main.tf")