"""Repository structure guardrails for the GitOps control plane."""

from __future__ import annotations

import datetime as dt
import json
import stat
from pathlib import Path

import yaml

REPO_ROOT = Path(__file__).resolve().parents[2]


def _yaml_docs(path: Path) -> list[dict]:
    docs = []
    for doc in yaml.safe_load_all(path.read_text(encoding="utf-8")):
        if isinstance(doc, dict):
            docs.append(doc)
    return docs


def test_root_jenkinsfile_mirrors_canonical_pipeline() -> None:
    """The root Jenkinsfile exists for discovery, but CI logic lives in ci/."""
    root = (REPO_ROOT / "Jenkinsfile").read_text(encoding="utf-8").splitlines()
    canonical = (REPO_ROOT / "ci/Jenkinsfile.titan-iac").read_text(
        encoding="utf-8"
    ).splitlines()

    if root and root[0].startswith("// Mirror of "):
        root = root[1:]

    assert root == canonical


def test_suspended_flux_kustomizations_have_reasons() -> None:
    """Suspended reconciliations should say why they are parked."""
    missing = []
    for path in sorted((REPO_ROOT / "clusters/atlas/flux-system").rglob("*.yaml")):
        for doc in _yaml_docs(path):
            if doc.get("kind") != "Kustomization":
                continue
            if not str(doc.get("apiVersion") or "").startswith(
                "kustomize.toolkit.fluxcd.io/"
            ):
                continue
            spec = doc.get("spec") or {}
            if spec.get("suspend") is not True:
                continue
            annotations = (doc.get("metadata") or {}).get("annotations") or {}
            if not annotations.get("atlas.bstein.dev/suspend-reason"):
                missing.append(str(path.relative_to(REPO_ROOT)))

    assert missing == []


def test_trivy_waiver_targets_still_exist() -> None:
    """Waivers should stay temporary and point at files that still exist."""
    path = REPO_ROOT / "ci/titan-iac-trivy-waivers.json"
    payload = json.loads(path.read_text(encoding="utf-8"))
    expires = dt.date.fromisoformat(payload["default_expires_at"])
    assert expires >= dt.date.today()

    missing = []
    for entry in payload.get("misconfigurations", []):
        for target in entry.get("targets", []):
            if target and not (REPO_ROOT / target).exists():
                missing.append(f"{entry.get('id')}:{target}")

    assert missing == []


def test_oceanus_is_not_a_standalone_flux_cluster() -> None:
    """Oceanus now belongs to Atlas capacity, not a separate Flux root."""
    assert not (REPO_ROOT / "clusters/oceanus").exists()
    assert not (REPO_ROOT / "infrastructure/modules/profiles/oceanus-validator").exists()


def test_service_job_directories_use_lifecycle_names() -> None:
    """Manual job folders should say when they are used."""
    old_dirs = list((REPO_ROOT / "services").rglob("oneoffs"))
    assert old_dirs == []

    stale_refs = []
    for root in ["clusters", "services", "ci", "testing"]:
        for path in (REPO_ROOT / root).rglob("*"):
            if not path.is_file():
                continue
            if path == Path(__file__).resolve():
                continue
            if path.suffix not in {".json", ".py", ".yaml", ".yml"}:
                continue
            if "oneoffs" in path.read_text(encoding="utf-8"):
                stale_refs.append(str(path.relative_to(REPO_ROOT)))

    assert stale_refs == []


def test_knowledge_service_mirror_matches_source() -> None:
    """Atlasbot should serve the generated knowledge tree, not a fork."""
    source = REPO_ROOT / "knowledge"
    mirror = REPO_ROOT / "services/comms/knowledge"
    source_files = sorted(path.relative_to(source) for path in source.rglob("*") if path.is_file())
    mirror_files = sorted(path.relative_to(mirror) for path in mirror.rglob("*") if path.is_file())

    assert mirror_files == source_files
    mismatched = [
        str(rel)
        for rel in source_files
        if (source / rel).read_bytes() != (mirror / rel).read_bytes()
    ]
    assert mismatched == []


def test_scripts_shell_entrypoints_are_executable_with_shebangs() -> None:
    """Runnable shell and Fish helpers should not need tribal chmod knowledge."""
    broken = []
    for path in sorted((REPO_ROOT / "scripts").rglob("*")):
        if path.suffix not in {".sh", ".fish"} or not path.is_file():
            continue
        mode = path.stat().st_mode
        first_line = path.read_text(encoding="utf-8").splitlines()[0]
        if not mode & stat.S_IXUSR or not first_line.startswith("#!"):
            broken.append(str(path.relative_to(REPO_ROOT)))

    assert broken == []