"""Pinned Go bootstrap contracts for isolated Hermes execution workers."""

from __future__ import annotations

import os
import subprocess
from pathlib import Path

import pytest
import yaml


ROOT = Path(__file__).parents[2]
HERMES = ROOT / "services/hermes"
INSTALLER = HERMES / "scripts/install_worker_go.sh"


def _write_executable(path: Path, text: str) -> None:
    path.write_text(text)
    path.chmod(0o755)


def _run_installer(tmp_path: Path, architecture: str, download_arch: str) -> Path:
    """Run the installer against fake verified archive tools without network access."""
    tools, mock = tmp_path / "tools", tmp_path / "mock"
    mock.mkdir()
    curl_log = tmp_path / "curl.log"
    _write_executable(mock / "uname", '#!/bin/sh\nprintf "%s\\n" "$TEST_ARCH"\n')
    _write_executable(
        mock / "curl",
        """#!/bin/sh
last=""
destination=""
previous=""
for argument in "$@"; do
  if [ "$previous" = "-o" ]; then destination=$argument; fi
  previous=$argument
  last=$argument
done
printf "%s" "$last" > "$CURL_LOG"
printf archive > "$destination"
""",
    )
    _write_executable(mock / "sha256sum", '#!/bin/sh\ncat >/dev/null\n')
    _write_executable(
        mock / "tar",
        '''#!/bin/sh
while [ "$#" -gt 0 ]; do
  if [ "$1" = "-C" ]; then work=$2; shift 2; continue; fi
  shift
done
mkdir -p "$work/go/bin"
printf '#!/bin/sh\\nprintf "go version go1.26.5 linux/%%s\\\\n" "$TEST_DL_ARCH"\\n' > "$work/go/bin/go"
printf '#!/bin/sh\\n[ "$1" = "-w" ] && [ -f "$2" ]\\n' > "$work/go/bin/gofmt"
chmod 0755 "$work/go/bin/go" "$work/go/bin/gofmt"
''',
    )
    root = tools / f"go-1.26.5-{download_arch}"
    (root / "bin").mkdir(parents=True)
    _write_executable(root / "bin/go", "#!/bin/sh\nexit 1\n")
    environment = {
        **os.environ,
        "PATH": f"{mock}:/usr/bin:/bin",
        "HERMES_WORKER_TOOLS_DIR": str(tools),
        "TEST_ARCH": architecture,
        "TEST_DL_ARCH": download_arch,
        "CURL_LOG": str(curl_log),
    }
    subprocess.run(["/bin/sh", str(INSTALLER)], env=environment, check=True)
    assert curl_log.read_text().endswith(f"go1.26.5.linux-{download_arch}.tar.gz")
    assert (tools / f".worker-go-toolchain-1.26.5-{download_arch}").is_file()
    assert subprocess.check_output(
        [tools / "bin/go", "version"], text=True, env=environment
    ).strip() == f"go version go1.26.5 linux/{download_arch}"
    subprocess.run([tools / "bin/gofmt", "-w", str(tmp_path / "formatted.go")], check=False)
    return tools


@pytest.mark.parametrize(("architecture", "download_arch"), [("aarch64", "arm64"), ("x86_64", "amd64")])
def test_worker_go_installer_recovers_incomplete_arch_cache(tmp_path, architecture, download_arch):
    """An incomplete cached tree is replaced only with the verified native archive."""
    tools = _run_installer(tmp_path, architecture, download_arch)
    assert (tools / f"go-1.26.5-{download_arch}/bin/gofmt").is_file()


def test_worker_manifest_installs_only_pinned_go_on_writable_tools_claim():
    """The worker gets Go before model binaries without operator credentials or mounts."""
    document = yaml.safe_load(HERMES.joinpath("execution-worker-statefulset.yaml").read_text())
    init = next(item for item in document["spec"]["template"]["spec"]["initContainers"] if item["name"] == "install-worker-go")
    assert init["command"] == [
        "/bin/sh", "-ec", "timeout 300 /bin/sh /opt/coordinator/install_worker_go.sh"
    ]
    assert {mount["name"] for mount in init["volumeMounts"]} == {"tools", "coordinator"}
    assert not next(mount for mount in init["volumeMounts"] if mount["name"] == "tools").get("readOnly", False)
    assert next(mount for mount in init["volumeMounts"] if mount["name"] == "coordinator")["readOnly"] is True
    kustomization = yaml.safe_load(HERMES.joinpath("kustomization.yaml").read_text())
    pool = next(
        item for item in kustomization["configMapGenerator"]
        if item["name"] == "hermes-execution-pool"
    )
    assert "install_worker_go.sh=scripts/install_worker_go.sh" in pool["files"]
    script = INSTALLER.read_text()
    assert "sha256sum -c -" in script and "go${version}.linux-${dl_arch}.tar.gz" in script
    assert "version=1.26.5" in script
    assert 'timeout 15 "${root}/bin/go" version' in script
    assert 'timeout 15 "${root}/bin/gofmt" -w' in script
    assert "--connect-timeout 15 --max-time 90 --retry 2 --retry-delay 2" in script