"""Contracts for isolated high-quality Hermes chat capabilities."""

from __future__ import annotations

import importlib.util
from pathlib import Path

import yaml


ROOT = Path(__file__).parents[2]
HERMES = ROOT / "services" / "hermes"


def _documents(path: Path) -> list[dict]:
    return [doc for doc in yaml.safe_load_all(path.read_text()) if doc]


def test_chat_config_enables_real_research_compute_and_delegation():
    configmap = _documents(HERMES / "chat-configmap.yaml")[0]
    config = yaml.safe_load(configmap["data"]["config.yaml"])

    assert config["agent"]["reasoning_effort"] == "high"
    assert config["web"] == {
        "backend": "ddgs",
        "search_backend": "ddgs",
        "extract_backend": "public-extract",
    }
    assert config["delegation"]["max_concurrent_children"] == 2
    assert config["delegation"]["max_iterations"] == 80
    assert config["agent"]["max_turns"] == 120
    assert config["tool_loop_guardrails"]["hard_stop_enabled"] is True
    for platform in ("cli", "api_server"):
        toolsets = config["platform_toolsets"][platform]
        assert "delegation" in toolsets
        assert "browser" in toolsets
        assert "python_sandbox" in toolsets
        assert "vision" in toolsets
        assert "web" in toolsets
        assert "terminal" not in toolsets
        assert "code_execution" not in toolsets


def test_sandbox_has_no_credentials_token_or_egress():
    sandbox_docs = _documents(HERMES / "chat-sandbox.yaml")
    statefulset = next(doc for doc in sandbox_docs if doc["kind"] == "StatefulSet")
    pod_spec = statefulset["spec"]["template"]["spec"]
    container = pod_spec["containers"][0]

    assert pod_spec["automountServiceAccountToken"] is False
    assert container["securityContext"]["readOnlyRootFilesystem"] is True
    assert container["securityContext"]["runAsNonRoot"] is True
    assert not container.get("env")
    assert {mount["mountPath"] for mount in container["volumeMounts"]} == {
        "/tmp",
        "/workspace",
    }

    policies = _documents(HERMES / "networkpolicy.yaml")
    deny = next(
        doc
        for doc in policies
        if doc["kind"] == "NetworkPolicy"
        and doc["metadata"]["name"] == "hermes-chat-sandbox-deny"
    )
    assert deny["spec"]["policyTypes"] == ["Ingress", "Egress"]
    assert deny["spec"]["egress"] == []
    for ordinal in range(4):
        policy = next(
            doc
            for doc in policies
            if doc["kind"] == "NetworkPolicy"
            and doc["metadata"]["name"] == f"hermes-chat-sandbox-tenant-{ordinal}"
        )
        assert policy["spec"]["podSelector"]["matchLabels"][
            "apps.kubernetes.io/pod-index"
        ] == str(ordinal)
        source = policy["spec"]["ingress"][0]["from"][0]["podSelector"][
            "matchLabels"
        ]
        assert source["apps.kubernetes.io/pod-index"] == str(ordinal)


def test_gateway_image_honors_ui_model_and_caps_reasoning():
    dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-agent").read_text()
    assert "_resolve_request_route" in dockerfile
    assert 'allowed_providers = {"openai-codex", "anthropic"}' in dockerfile
    assert 'reasoning_effort=body.get("reasoning_effort")' in dockerfile
    assert 'reasoning_config = {"enabled": True, "effort": "xhigh"}' in dockerfile
    assert "ddgs==9.14.4" in dockerfile
    assert "specific not in _LEGACY_WEB_BACKENDS" in dockerfile


def test_chat_oauth_allows_stale_service_worker_retirement():
    documents = _documents(HERMES / "oauth2-proxy.yaml")
    deployment = next(
        document
        for document in documents
        if document["kind"] == "Deployment"
        and document["metadata"]["name"] == "oauth2-proxy-hermes-chat"
    )
    args = deployment["spec"]["template"]["spec"]["containers"][0]["args"]

    assert "--skip-auth-route=GET=^/sw[.]js([?].*)?$" in args
    assert "--custom-templates-dir=/etc/oauth2-proxy/templates" in args

    template = (HERMES / "oauth2-proxy-templates" / "error.html").read_text()
    assert 'http-equiv="refresh"' in template
    assert "Unable to find a valid CSRF token" in template
    assert "expired or was already used" in template
    assert "/sign_in?rd=/" in template
    container = deployment["spec"]["template"]["spec"]["containers"][0]
    assert "v7.15.3@sha256:10a1165743a192e" in container["image"]
    assert "--cookie-csrf-per-request=true" in args
    assert "--cookie-csrf-per-request-limit=8" in args
    assert "--trusted-proxy-ip=10.42.0.0/16" in args


def test_chat_auth_file_mount_survives_atomic_provider_refresh():
    statefulset = _documents(HERMES / "chat-statefulset.yaml")[0]
    containers = statefulset["spec"]["template"]["spec"]["containers"]

    for name in ("hermes", "webui"):
        container = next(item for item in containers if item["name"] == name)
        env = {item["name"]: item["value"] for item in container["env"]}
        assert env["HERMES_AUTH_FILE"] == "/shared-auth/auth.json"
        mount = next(
            item for item in container["volumeMounts"] if item["name"] == "provider-auth"
        )
        assert mount["mountPath"] == "/shared-auth"
        assert "subPath" not in mount

    hermes_env = {
        item["name"]: item["value"]
        for item in next(item for item in containers if item["name"] == "hermes")["env"]
    }
    assert hermes_env["AGENT_BROWSER_EXECUTABLE_PATH"].endswith("/chrome-linux/headless_shell")
    assert "--no-sandbox" in hermes_env["AGENT_BROWSER_ARGS"]


def test_sandbox_executes_python_with_bounded_output(tmp_path: Path, monkeypatch):
    source = ROOT / "dockerfiles" / "hermes-chat-sandbox-server.py"
    spec = importlib.util.spec_from_file_location("hermes_chat_sandbox_server", source)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    monkeypatch.setattr(module, "WORKSPACE", tmp_path)

    result = module._execute("import math\nprint(math.comb(10, 3))")

    assert result["success"] is True
    assert result["stdout"] == "120\n"
    assert result["stderr"] == ""