from __future__ import annotations

import json
import subprocess
import sys
import tempfile
import unittest
from pathlib import Path

from scripts import render_serviceification_test_stack as render
from scripts import validate_serviceification_bom as bom_validator


class RuntimeAdmissionTests(unittest.TestCase):
    def test_navigation_is_current_configuration_with_one_explicit_owner(self) -> None:
        root = Path(__file__).resolve().parents[1]
        bom = json.loads((root / "release/serviceification-d3-bom.json").read_text())
        capability = "runtime.application-navigation.v1"
        selected = [c["runtime_capability_id"] for c in bom["app_installation"]["capabilities"]]
        grants = bom["catalog_consumers"]["runtime_capability_grants"]
        catalog, workload = render.d3_partition_runtime_capability_grants(grants)
        self.assertNotIn(capability, selected)
        self.assertNotIn(capability, [g["capability_id"] for g in catalog])
        with self.assertRaisesRegex(render.ValidationFailure, "application owner"):
            render.d3_workload_capabilities(workload, "35s")
        rendered = render.d3_workload_capabilities(workload, "35s", application_owner_id="crm")
        self.assertEqual([c for c in rendered if c["runtime_capability_id"] == capability], [{
            "runtime_capability_id": capability,
            "authorized_workload_id": bom["catalog_consumers"]["handler_workload_id"],
            "application_owner_id": "crm", "admission_lease": "35s",
        }])
        self.assertIn(capability, render.d3_session_scope_capabilities(selected, grants))

    def test_declared_layout_v2_uses_existing_workload_and_session_path(self) -> None:
        root = Path(__file__).resolve().parents[1]
        bom = json.loads((root / "release/serviceification-d3-bom.json").read_text())
        capability = "runtime.layout.authoring.v2"
        selected = [c["runtime_capability_id"] for c in bom["app_installation"]["capabilities"]]
        grants = bom["catalog_consumers"]["runtime_capability_grants"]
        self.assertNotIn(capability, selected)
        catalog, workload = render.d3_partition_runtime_capability_grants(grants)
        self.assertNotIn(capability, [g["capability_id"] for g in catalog])
        self.assertEqual([c for c in render.d3_workload_capabilities(workload, "35s", application_owner_id="crm")
                          if c["runtime_capability_id"] == capability], [{
            "runtime_capability_id": capability,
            "authorized_workload_id": bom["catalog_consumers"]["handler_workload_id"],
            "admission_lease": "35s",
        }])
        self.assertIn(capability, render.d3_session_scope_capabilities(selected, grants))
        self.assertNotIn(capability, render.d3_session_scope_capabilities(selected, []))

    def test_deployment_entrypoints_validate_bom_before_environment_access(self) -> None:
        root = Path(__file__).resolve().parents[1]
        with tempfile.TemporaryDirectory() as directory:
            bom = Path(directory) / "invalid.json"
            bom.write_text("{}")
            for environment in ("test1", "test2"):
                with self.subTest(environment=environment):
                    command = [sys.executable, str(root / f"scripts/manage_{environment}_apprelease.py"),
                               "upgrade", "--resolved-bom", str(bom), "--catalog-image", "unused"]
                    for argument in ("env-file", "app-packs-root", "core-root", "l2-root",
                                     "deployment-tools", "approval-publication", "l0-state-root"):
                        command.extend(["--" + argument, str(Path(directory) / "absent" / argument)])
                    result = subprocess.run(command, capture_output=True, text=True, timeout=15)
                    self.assertEqual(1, result.returncode, result.stdout + result.stderr)
                    self.assertIn("BOM", result.stderr)
                    self.assertNotIn("absent", result.stderr)

    def test_admission_policy_rejects_invalid_authority_without_fixing_it(self) -> None:
        root = Path(__file__).resolve().parents[1]
        baseline = json.loads((root / "release/serviceification-d3-bom.json").read_text())
        self.assertEqual([], bom_validator.validate_v10_admission_policy(baseline))
        for kind, message in (
            ("duplicate", "one workload per capability"),
            ("catalog", "Workload-only capabilities cannot be selected through Catalog"),
        ):
            with self.subTest(kind=kind):
                bom = json.loads(json.dumps(baseline))
                grants = bom["catalog_consumers"]["runtime_capability_grants"]
                capability = "runtime.layout.authoring.v2"
                if kind == "duplicate":
                    grants.append({"authorized_workload_id": "integration-service",
                                   "capability_id": capability})
                    grants.sort(key=lambda grant: (grant["authorized_workload_id"], grant["capability_id"]))
                else:
                    grants[:] = [grant for grant in grants if grant["capability_id"] != capability]
                    bom["app_installation"]["capabilities"].append({
                        "capability_id": "io.nexuscrm.sfcrm.layout-authoring.v1",
                        "runtime_capability_id": capability,
                    })
                    bom["app_installation"]["capabilities"].sort(key=lambda binding: binding["capability_id"])
                original = json.dumps(bom, sort_keys=True)
                errors = bom_validator.validate_v10_admission_policy(bom)
                self.assertEqual(1, len(errors), errors)
                self.assertIn(message, errors[0])
                self.assertEqual(original, json.dumps(bom, sort_keys=True))

    def test_layout_handler_needs_its_workload_grant_not_a_catalog_binding(self) -> None:
        package = {"canonical_manifest": {"provided_capabilities": [{
            "capability_id": "io.nexuscrm.sfcrm.layout-authoring.v1",
            "handler_ref": "io.nexuscrm.sfcrm.handler.layout-authoring.v1",
            "required_runtime_capabilities": ["runtime.layout.authoring.v2"],
        }]}}
        self.assertEqual(bom_validator.app_package_composite_capability_selections(
            package, [], bom_validator.D3_WORKLOAD_ONLY_APP_CAPABILITY_BINDINGS,
        ), [])
        with self.assertRaisesRegex(bom_validator.ValidationFailure, "does not cover"):
            bom_validator.app_package_composite_capability_selections(package, [])


if __name__ == "__main__":
    unittest.main()