"""Private lab transport regression fixtures; never contacts a real cluster."""
import json
import os
from pathlib import Path
import subprocess

import pytest

ROOT = Path(__file__).resolve().parents[1]
SCRIPT = ROOT / 'sso-mfa/bootstrap/openbao-init-unseal.sh'


@pytest.fixture
def lab(tmp_path):
    metadata = tmp_path / 'metadata.json'
    metadata.write_text(json.dumps({'deployment_profile': 'lab', 'openbao_unseal_custody_model': 'sops-held-automation'}))
    source = tmp_path / 'secrets'; source.mkdir(mode=0o700)
    executable = tmp_path / 'kubectl'
    executable.write_text('''#!/usr/bin/python3
import json,os,pathlib,sys
root=pathlib.Path(os.environ['KUBECONFIG']).parent
state=root/'fixture-state.json'
x=json.loads(state.read_text()) if state.exists() else {'initialized':False,'sealed':True,'applied':0}
args=sys.argv[1:]
with (root/'calls.jsonl').open('a') as log: log.write(json.dumps(args)+'\\n')
assert not any(k in os.environ for k in ['VAULT_TOKEN','BAO_TOKEN','BASH_ENV'])
if args[:3]==['get','namespace','kube-system']:
 print(json.dumps({'metadata':{'uid':'fixture-cluster'}}))
elif 'get' in args:
 print(json.dumps({'metadata':{'uid':'fixture-pod','name':'openbao-0','namespace':'openbao'}}))
elif 'status' in args:
 print(json.dumps(x));sys.exit(2 if x['sealed'] else 0)
elif 'init' in args:
 x['initialized']=True;state.write_text(json.dumps(x))
 print(json.dumps({'unseal_keys_b64':['A'*32,'B'*32,'C'*32], 'root_token':'fixture-private-root-marker'}))
elif 'sys/unseal' in args:
 assert sys.stdin.read().strip() in ['A'*32,'B'*32,'C'*32]
 x['applied']+=1;x['sealed']=x['applied']<2;state.write_text(json.dumps(x))
 print('fixture-private-provider-response')
else: sys.exit(1)
print('fixture-private-provider-diagnostic',file=sys.stderr)
''')
    executable.chmod(0o755)
    env = {'PATH': str(tmp_path) + ':' + os.environ['PATH'], 'HOME': str(tmp_path),
           'KUBECONFIG': str(tmp_path / 'fixture-kubeconfig'),
           'OPENBAO_CONSOLE_METADATA': str(metadata), 'OPENBAO_EXPECTED_CLUSTER_UID': 'fixture-cluster',
           'VAULT_TOKEN': 'fixture-ambient-token', 'BAO_TOKEN': 'fixture-ambient-token'}
    return source, env, tmp_path


def invoke(lab):
    source, env, _ = lab
    return subprocess.run(['bash', '-x', str(SCRIPT), str(source)], env=env, capture_output=True, timeout=10)


def test_lab_init_unseal_keeps_material_private_and_never_uses_secret_argv(lab):
    source, _, root = lab
    r = invoke(lab)
    assert r.returncode == 0
    transcript = r.stdout + r.stderr
    assert not any(x in transcript for x in [b'fixture-private-root-marker', b'fixture-private-provider-response',
                                             b'fixture-private-provider-diagnostic', b'A'*32, b'B'*32])
    material = source / 'openbao/init.json'
    assert material.stat().st_mode & 0o077 == 0
    calls = (root / 'calls.jsonl').read_bytes()
    assert b'fixture-private-root-marker' not in calls
    assert b'A'*32 not in calls and b'B'*32 not in calls
    assert json.loads((root / 'fixture-state.json').read_text())['applied'] == 2


def test_prior_init_material_refuses_new_init_without_overwrite(lab):
    source, _, root = lab
    directory = source / 'openbao'; directory.mkdir(mode=0o700)
    file = directory / 'init.json'; file.write_bytes(b'fixture-existing-custody'); file.chmod(0o600)
    r = invoke(lab)
    assert r.returncode != 0
    assert file.read_bytes() == b'fixture-existing-custody'
    assert not (root / 'fixture-state.json').exists()
    assert b'"init"' not in (root / 'calls.jsonl').read_bytes()


@pytest.mark.parametrize('mutation', ['wrong-cluster', 'missing-profile', 'production', 'configure-initial'])
def test_lab_rejects_unadmitted_targets_and_automatic_root_followthrough(lab, mutation):
    _, env, root = lab
    if mutation == 'wrong-cluster': env['OPENBAO_EXPECTED_CLUSTER_UID'] = 'different-cluster'
    elif mutation == 'configure-initial': env['OPENBAO_RUN_CONFIGURE_INITIAL'] = '1'
    else:
        data=json.loads(Path(env['OPENBAO_CONSOLE_METADATA']).read_text())
        if mutation == 'missing-profile': data.pop('deployment_profile')
        else: data['deployment_profile']='production'
        Path(env['OPENBAO_CONSOLE_METADATA']).write_text(json.dumps(data))
    r=invoke(lab)
    assert r.returncode != 0
    assert not (root/'fixture-state.json').exists()