"""Contracts for isolated high-quality Hermes chat capabilities."""

from __future__ import annotations

import importlib.util
from pathlib import Path

import yaml


ROOT = Path(__file__).parents[2]
HERMES = ROOT / "services" / "hermes"


def _documents(path: Path) -> list[dict]:
    return [doc for doc in yaml.safe_load_all(path.read_text()) if doc]


def test_chat_config_enables_real_research_compute_and_delegation():
    configmap = _documents(HERMES / "chat-configmap.yaml")[0]
    config = yaml.safe_load(configmap["data"]["config.yaml"])

    assert config["agent"]["reasoning_effort"] == "high"
    assert config["web"] == {
        "backend": "ddgs",
        "search_backend": "ddgs",
        "extract_backend": "public-extract",
    }
    assert config["delegation"]["max_concurrent_children"] == 2
    assert config["delegation"]["max_iterations"] == 80
    assert config["agent"]["max_turns"] == 120
    assert config["tool_loop_guardrails"]["hard_stop_enabled"] is True
    for platform in ("cli", "api_server"):
        toolsets = config["platform_toolsets"][platform]
        assert "delegation" in toolsets
        assert "python_sandbox" in toolsets
        assert "web" in toolsets
        assert "terminal" not in toolsets
        assert "code_execution" not in toolsets


def test_sandbox_has_no_credentials_token_or_egress():
    sandbox_docs = _documents(HERMES / "chat-sandbox.yaml")
    statefulset = next(doc for doc in sandbox_docs if doc["kind"] == "StatefulSet")
    pod_spec = statefulset["spec"]["template"]["spec"]
    container = pod_spec["containers"][0]

    assert pod_spec["automountServiceAccountToken"] is False
    assert container["securityContext"]["readOnlyRootFilesystem"] is True
    assert container["securityContext"]["runAsNonRoot"] is True
    assert not container.get("env")
    assert {mount["mountPath"] for mount in container["volumeMounts"]} == {
        "/tmp",
        "/workspace",
    }

    policies = _documents(HERMES / "networkpolicy.yaml")
    deny = next(
        doc
        for doc in policies
        if doc["kind"] == "NetworkPolicy"
        and doc["metadata"]["name"] == "hermes-chat-sandbox-deny"
    )
    assert deny["spec"]["policyTypes"] == ["Ingress", "Egress"]
    assert deny["spec"]["egress"] == []
    for ordinal in range(4):
        policy = next(
            doc
            for doc in policies
            if doc["kind"] == "NetworkPolicy"
            and doc["metadata"]["name"] == f"hermes-chat-sandbox-tenant-{ordinal}"
        )
        assert policy["spec"]["podSelector"]["matchLabels"][
            "apps.kubernetes.io/pod-index"
        ] == str(ordinal)
        source = policy["spec"]["ingress"][0]["from"][0]["podSelector"][
            "matchLabels"
        ]
        assert source["apps.kubernetes.io/pod-index"] == str(ordinal)


def test_gateway_image_honors_ui_model_and_caps_reasoning():
    dockerfile = (ROOT / "dockerfiles" / "Dockerfile.hermes-agent").read_text()
    assert "_resolve_request_route" in dockerfile
    assert 'allowed_providers = {"openai-codex", "anthropic"}' in dockerfile
    assert 'reasoning_effort=body.get("reasoning_effort")' in dockerfile
    assert 'reasoning_config = {"enabled": True, "effort": "xhigh"}' in dockerfile
    assert "ddgs==9.14.4" in dockerfile
    assert "specific not in _LEGACY_WEB_BACKENDS" in dockerfile


def test_chat_oauth_allows_stale_service_worker_retirement():
    documents = _documents(HERMES / "oauth2-proxy.yaml")
    deployment = next(
        document
        for document in documents
        if document["kind"] == "Deployment"
        and document["metadata"]["name"] == "oauth2-proxy-hermes-chat"
    )
    args = deployment["spec"]["template"]["spec"]["containers"][0]["args"]

    assert "--skip-auth-route=GET=^/sw[.]js([?].*)?$" in args


def test_sandbox_executes_python_with_bounded_output(tmp_path: Path, monkeypatch):
    source = ROOT / "dockerfiles" / "hermes-chat-sandbox-server.py"
    spec = importlib.util.spec_from_file_location("hermes_chat_sandbox_server", source)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    monkeypatch.setattr(module, "WORKSPACE", tmp_path)

    result = module._execute("import math\nprint(math.comb(10, 3))")

    assert result["success"] is True
    assert result["stdout"] == "120\n"
    assert result["stderr"] == ""