import json
import os
import sys
import tempfile
import unittest
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]
RUNTIME_DIR = ROOT / "deployments" / "offline" / "runtime"
sys.path.insert(0, str(RUNTIME_DIR))

import resolve_active_d3_runtime_truth as resolver  # noqa: E402


class ActiveD3RuntimeTruthTests(unittest.TestCase):
    def fixture(
        self,
        root: Path,
        *,
        environment: str = "test",
        slot: str = "test2",
    ) -> tuple[Path, Path, Path]:
        if environment == "staging":
            env_root = (root / "staging" / slot).resolve()
            env_name = f"staging-{slot}"
            run_id = f"d3-staging-{slot}-123"
        else:
            env_root = (root / slot).resolve()
            env_name = f"test-{slot}"
            run_id = f"d3-{slot}-123"
        run_root = env_root / ".runtime" / "serviceification-d3" / "runs" / run_id
        runtime_env = run_root / "private" / "runtime.env"
        runtime_env.parent.mkdir(parents=True)
        runtime_env.write_text(
            "FILE_STORAGE_PROVIDER=filesystem\nFILE_STORAGE_ROOT=/srv/files\n",
            encoding="utf-8",
        )
        os.chmod(runtime_env, 0o600)

        base_env = env_root / "env" / "runtime.env"
        base_env.parent.mkdir(parents=True)
        base_env.write_text(
            f"ENV_NAME={env_name}\nENV_ROOT={env_root}\n",
            encoding="utf-8",
        )
        os.chmod(base_env, 0o600)

        state_file = env_root / ".runtime" / "serviceification-d3" / "active.json"
        state = {
            "phase": "serving",
            "envName": env_name,
            "envRoot": str(env_root),
            "runId": run_id,
            "runRoot": str(run_root),
            "desiredBomDigest": "sha256:" + "a" * 64,
            "exactSources": {"l2Commit": "b" * 40},
            "servingArtifacts": {"runtimeEnv": str(runtime_env)},
            "deploymentEvidence": {"stage": "serving-verified", "runId": run_id},
        }
        state_file.write_text(json.dumps(state), encoding="utf-8")
        os.chmod(state_file, 0o600)
        return base_env, runtime_env, state_file

    def test_resolves_serving_runtime_authority_from_active_d3_state(self):
        with tempfile.TemporaryDirectory() as tmp:
            base_env, runtime_env, _ = self.fixture(Path(tmp))
            os.chmod(base_env, 0o644)

            result = resolver.resolve_active_d3_runtime_truth(base_env)

        self.assertEqual("d3-test2-123", result["run_id"])
        self.assertEqual(str(runtime_env), result["runtime_env_file"])
        self.assertEqual("b" * 40, result["l2_metadata_commit"])

    def test_resolves_active_staging_slot_runtime_authority(self):
        with tempfile.TemporaryDirectory() as tmp:
            base_env, runtime_env, _ = self.fixture(
                Path(tmp), environment="staging", slot="green"
            )

            result = resolver.resolve_active_d3_runtime_truth(base_env)

        self.assertEqual("staging-green", result["env_name"])
        self.assertEqual("d3-staging-green-123", result["run_id"])
        self.assertEqual(str(runtime_env), result["runtime_env_file"])

    def test_rejects_state_without_serving_verification(self):
        with tempfile.TemporaryDirectory() as tmp:
            base_env, _, state_file = self.fixture(Path(tmp))
            state = json.loads(state_file.read_text(encoding="utf-8"))
            state["deploymentEvidence"] = None
            state_file.write_text(json.dumps(state), encoding="utf-8")

            with self.assertRaisesRegex(
                resolver.DeployError, "serving-verified evidence"
            ):
                resolver.resolve_active_d3_runtime_truth(base_env)

    def test_rejects_runtime_authority_outside_active_run(self):
        with tempfile.TemporaryDirectory() as tmp:
            root = Path(tmp)
            base_env, _, state_file = self.fixture(root)
            outside = root / "outside.env"
            outside.write_text("FILE_STORAGE_PROVIDER=s3\n", encoding="utf-8")
            os.chmod(outside, 0o600)
            state = json.loads(state_file.read_text(encoding="utf-8"))
            state["servingArtifacts"]["runtimeEnv"] = str(outside)
            state_file.write_text(json.dumps(state), encoding="utf-8")

            with self.assertRaisesRegex(resolver.DeployError, "sealed run root"):
                resolver.resolve_active_d3_runtime_truth(base_env)

    def test_rejects_symlink_at_sealed_runtime_authority_path(self):
        with tempfile.TemporaryDirectory() as tmp:
            root = Path(tmp)
            base_env, runtime_env, _ = self.fixture(root)
            outside = root / "outside.env"
            outside.write_text("FILE_STORAGE_PROVIDER=s3\n", encoding="utf-8")
            os.chmod(outside, 0o600)
            runtime_env.unlink()
            runtime_env.symlink_to(outside)

            with self.assertRaisesRegex(resolver.DeployError, "non-symlink file"):
                resolver.resolve_active_d3_runtime_truth(base_env)

    def test_rejects_runtime_authority_outside_declared_env_root(self):
        with tempfile.TemporaryDirectory() as tmp:
            root = Path(tmp)
            base_env, _, _ = self.fixture(root)
            misplaced = root / "misplaced" / "runtime.env"
            misplaced.parent.mkdir()
            misplaced.write_text(base_env.read_text(encoding="utf-8"), encoding="utf-8")

            with self.assertRaisesRegex(resolver.DeployError, "canonical ENV_ROOT"):
                resolver.resolve_active_d3_runtime_truth(misplaced)

    def test_rejects_env_name_that_disagrees_with_test_slot(self):
        with tempfile.TemporaryDirectory() as tmp:
            base_env, _, _ = self.fixture(Path(tmp))
            base_env.write_text(
                base_env.read_text(encoding="utf-8").replace(
                    "ENV_NAME=test-test2", "ENV_NAME=test-test1"
                ),
                encoding="utf-8",
            )

            with self.assertRaisesRegex(
                resolver.DeployError, "match its Test or Staging slot"
            ):
                resolver.resolve_active_d3_runtime_truth(base_env)

    def test_rejects_staging_name_outside_staging_slot_root(self):
        with tempfile.TemporaryDirectory() as tmp:
            root = Path(tmp)
            base_env, _, _ = self.fixture(root)
            env_root = (root / "test2").resolve()
            base_env.write_text(
                f"ENV_NAME=staging-blue\nENV_ROOT={env_root}\n",
                encoding="utf-8",
            )

            with self.assertRaisesRegex(
                resolver.DeployError, "match its Test or Staging slot"
            ):
                resolver.resolve_active_d3_runtime_truth(base_env)


if __name__ == "__main__":
    unittest.main()