from __future__ import annotations

from pathlib import Path

import yaml


ROOT = Path(__file__).resolve().parents[1]
REMOVED_CREDENTIAL_SETTINGS = {
    "CLOUD_PUBLIC_CREDENTIALS_JSON",
    "CLOUD_HOST_CREDENTIALS_JSON",
    "CLOUD_ENROLLMENT_TOKENS_JSON",
    "CLOUD_SELF_SERVICE_ENROLLMENT_ENABLED",
    "CLOUD_CONSOLE_STATIC_DIR",
    "HOST_AGENT_HOST_ID",
    "HOST_AGENT_TOKEN",
    "HOST_AGENT_ENROLLMENT_TOKEN",
}


def test_compose_defines_database_control_plane_and_outbound_host_agent() -> None:
    compose = yaml.safe_load((ROOT / "compose.yaml").read_text(encoding="utf-8"))
    services = compose["services"]

    assert set(services) == {"postgres", "cloud-api", "host-agent"}
    assert services["postgres"]["image"].startswith("postgres:18")
    assert services["cloud-api"]["depends_on"]["postgres"]["condition"] == (
        "service_healthy"
    )
    assert services["host-agent"]["depends_on"]["cloud-api"]["condition"] == (
        "service_healthy"
    )
    assert "ports" not in services["host-agent"]
    assert services["host-agent"]["volumes"] == [
        "${HOST_AGENT_TASKS_PATH:-./tasks}:/app/tasks"
    ]
    assert (
        services["host-agent"]["environment"]["HOST_AGENT_CONTROL_PLANE_URL"]
        == "http://cloud-api:8001"
    )
    assert services["host-agent"]["environment"]["HOST_AGENT_IDENTITY_PATH"] == (
        "${HOST_AGENT_IDENTITY_PATH:-/app/tasks/host_identity.json}"
    )
    assert not (
        set(services["cloud-api"]["environment"])
        | set(services["host-agent"]["environment"])
    ) & REMOVED_CREDENTIAL_SETTINGS


def test_deploy_compose_has_only_cloud_services_and_required_environment() -> None:
    compose = yaml.safe_load(
        (ROOT / "compose.deploy.yaml").read_text(encoding="utf-8")
    )
    services = compose["services"]

    assert set(services) == {"postgres", "cloud-api"}
    assert services["cloud-api"]["image"].endswith(":${IMAGE_TAG:-latest}")
    assert services["cloud-api"]["environment"] == {
        "CLOUD_ENVIRONMENT": "production",
        "CLOUD_DATABASE_URL": (
            "postgresql+psycopg://${POSTGRES_USER}:${POSTGRES_PASSWORD}"
            "@postgres:5432/${POSTGRES_DB}"
        ),
        "CLOUD_TRUST_PROXY_HEADERS": "${CLOUD_TRUST_PROXY_HEADERS:-false}",
        "CLOUD_LLM_PROVIDER_ENCRYPTION_KEY": "${CLOUD_LLM_PROVIDER_ENCRYPTION_KEY}",
    }


def test_container_uses_locked_workspace_install_migrations_and_static_console() -> None:
    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
    compose = yaml.safe_load((ROOT / "compose.yaml").read_text(encoding="utf-8"))
    cloud_command = compose["services"]["cloud-api"]["command"][-1]

    assert "uv sync --locked --all-packages --no-dev" in dockerfile
    assert "CLOUD_CONSOLE_STATIC_DIR=/app/console-static" in dockerfile
    assert "alembic" in cloud_command
    assert "upgrade head" in cloud_command
    assert "device-cloud-api --host 0.0.0.0" in cloud_command


def test_example_environment_contains_no_static_credentials() -> None:
    values = {}
    for line in (ROOT / ".env.example").read_text(encoding="utf-8").splitlines():
        if line and not line.startswith("#"):
            name, value = line.split("=", 1)
            values[name] = value

    assert set(values) == {
        "IMAGE_TAG",
        "POSTGRES_DB",
        "POSTGRES_USER",
        "POSTGRES_PASSWORD",
        "CLOUD_API_PORT",
        "CLOUD_LLM_PROVIDER_ENCRYPTION_KEY",
    }
    assert not set(values) & REMOVED_CREDENTIAL_SETTINGS
    assert values["CLOUD_LLM_PROVIDER_ENCRYPTION_KEY"].startswith("change-me-")