from __future__ import annotations

import json
import sys
import tempfile
import unittest
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "scripts"))

from prepare_test2_l0_state import (  # noqa: E402
    StatePreparationError,
    prepare,
    runtime_environment,
    workload_identities,
)


class PrepareTest2L0StateTest(unittest.TestCase):
    def test_runtime_environment_contains_only_l0_runtime_inputs(self) -> None:
        value = runtime_environment({
            "TIDB_HOST": "db",
            "TIDB_PORT": "4000",
            "TIDB_USER": "user",
            "TIDB_PASSWORD": "secret",
            "TIDB_DATABASE": "crm",
            "JWT_SECRET": "jwt-secret",
            "PUBLIC_BASE_URL": "https://example.test/",
            "UNRELATED_APP_VERSION": "must-not-cross",
        })
        self.assertEqual("https://example.test", value["API_BASE_URL"])
        self.assertEqual("filesystem", value["FILE_STORAGE_PROVIDER"])
        self.assertEqual("/var/lib/nexuscrm/files", value["FILE_STORAGE_ROOT"])
        self.assertNotIn("UNRELATED_APP_VERSION", value)

    def test_runtime_environment_preserves_test2_object_storage_authority(self) -> None:
        value = runtime_environment({
            "TIDB_HOST": "db",
            "TIDB_PORT": "4000",
            "TIDB_USER": "user",
            "TIDB_PASSWORD": "secret",
            "TIDB_DATABASE": "crm",
            "JWT_SECRET": "jwt-secret",
            "PUBLIC_BASE_URL": "https://example.test",
            "FILE_STORAGE_PROVIDER": "s3",
            "FILE_STORAGE_BUCKET": "test2-only",
            "FILE_STORAGE_PREFIX": "runtime/",
            "FILE_STORAGE_ROOT": "/home/ec2-user/offline/files",
            "FILE_STORAGE_LEGACY_UPLOAD_ROOT": "/home/ec2-user/offline/uploads",
            "NEXUSCRM_RUNTIME_ROOT": "/home/ec2-user/offline",
        })
        self.assertEqual("s3", value["FILE_STORAGE_PROVIDER"])
        self.assertEqual("test2-only", value["FILE_STORAGE_BUCKET"])
        self.assertEqual("runtime/", value["FILE_STORAGE_PREFIX"])
        self.assertEqual("/var/lib/nexuscrm/files", value["FILE_STORAGE_ROOT"])
        self.assertEqual(
            "/var/lib/nexuscrm/uploads", value["FILE_STORAGE_LEGACY_UPLOAD_ROOT"],
        )
        self.assertNotIn("NEXUSCRM_RUNTIME_ROOT", value)

    def test_workload_tokens_survive_an_upgrade(self) -> None:
        with tempfile.TemporaryDirectory() as raw:
            path = Path(raw) / "identities.json"
            path.write_text(json.dumps({
                "schema": "nexuscrm.runtime-workload-identities/v1",
                "identities": [{"workloadId": "api", "token": "stable"}],
            }))
            value = workload_identities(path, ["api", "worker"])
            by_id = {row["workloadId"]: row["token"] for row in value["identities"]}
            self.assertEqual("stable", by_id["api"])
            self.assertTrue(by_id["worker"])

    def test_prepare_writes_serving_state_and_preserves_file_data(self) -> None:
        with tempfile.TemporaryDirectory() as raw:
            root = Path(raw)
            state = root / "state"
            (state / "data/catalog").mkdir(parents=True)
            (state / "data/catalog/new").write_text("snapshot")
            serving = root / "serving.json"
            serving.write_text(json.dumps({
                "schema": "nexuscrm.runtime-api-serving/v4",
                "authorized_workload_ids": ["api"],
            }))
            (state / "data/files").mkdir(parents=True)
            (state / "data/files/record").write_text("preserved")
            (state / "secrets").mkdir(parents=True)
            (state / "secrets/workload-identities.json").write_text(json.dumps({
                "schema": "nexuscrm.runtime-workload-identities/v1",
                "identities": [{"workloadId": "api", "token": "stable"}],
            }))
            (state / "secrets/signing-keys.json").write_text(json.dumps({
                "schema": "nexuscrm.runtime-signing-keys/v1",
                "active": {"signing_key_id": "test", "private_key_base64": "value"},
                "overlap": [],
            }))
            env_file = root / "runtime.env"
            env_file.write_text(
                "TIDB_HOST=db\nTIDB_PORT=4000\nTIDB_USER=user\n"
                "TIDB_PASSWORD=secret\nTIDB_DATABASE=crm\n"
                "JWT_SECRET=jwt-secret\nPUBLIC_BASE_URL=https://example.test\n"
            )
            (state / "config").mkdir()
            (state / "config/runtime.env").write_text(
                'FILE_STORAGE_ADDITIONAL_S3_AUTHORITIES_JSON=[{"name":"existing-history"}]\n'
            )
            prepare(serving, state, env_file)
            self.assertEqual("snapshot", (state / "data/catalog/new").read_text())
            self.assertEqual("preserved", (state / "data/files/record").read_text())
            identities = json.loads((state / "secrets/workload-identities.json").read_text())
            self.assertEqual("stable", identities["identities"][0]["token"])
            self.assertIn('existing-history', (state / "config/runtime.env").read_text())

    def test_prepare_rejects_a_symlinked_catalog_store(self) -> None:
        with tempfile.TemporaryDirectory() as raw:
            root = Path(raw)
            state = root / "state"
            (state / "data").mkdir(parents=True)
            (state / "data/catalog").symlink_to(root)
            serving = root / "serving.json"
            serving.write_text(json.dumps({
                "schema": "nexuscrm.runtime-api-serving/v4",
                "authorized_workload_ids": ["api"],
            }))
            with self.assertRaisesRegex(StatePreparationError, "regular directory"):
                prepare(serving, state, root / "runtime.env")


if __name__ == "__main__":
    unittest.main()