from __future__ import annotations

import copy
import importlib.util
import pathlib
import sys

import pytest
import yaml

TOOL_PATH = pathlib.Path(__file__).resolve().parents[1] / "emission_cadence_profile.py"
SPEC = importlib.util.spec_from_file_location("emission_cadence_profile", TOOL_PATH)
profile = importlib.util.module_from_spec(SPEC)
assert SPEC and SPEC.loader
sys.modules[SPEC.name] = profile
SPEC.loader.exec_module(profile)


CONTRACT_SCHEMA = {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "type": "object",
    "required": ["schema_version", "source", "sources"],
    "properties": {
        "schema_version": {"const": "0.1"},
        "source": {"type": "string"},
        "sources": {
            "type": "array",
            "items": {
                "type": "object",
                "required": ["source_id", "event_class", "form"],
                "properties": {
                    "event_class": {"type": "string", "minLength": 1},
                    "extensions": {
                        "type": "object",
                        "additionalProperties": {"type": "object"},
                    },
                    "form": {"enum": ["expected-rate", "heartbeat-or-reconciliation"]},
                },
            },
        },
    },
}


def rare_entry() -> dict:
    return {
        "source_id": "example.audit.deny",
        "event_class": "audit.deny",
        "extensions": {
            "netkingdom": {
                "evidence_class": "load-bearing",
                "rate_monitoring": "forbidden",
            }
        },
        "form": "heartbeat-or-reconciliation",
        "heartbeat": {
            "event_class": "audit.heartbeat",
            "interval": "24h",
            "assertion": "nothing-to-report",
            "missing": "finding",
        },
        "reconciliation": {
            "compare_local": "source_transition_counts.audit.deny",
            "compare_observed": "evidence_counts.audit.deny",
            "divergence": "finding",
            "undrained_local": "lag-not-divergence",
        },
    }


def declaration(*entries: dict) -> dict:
    return {"schema_version": "0.1", "source": "example", "sources": list(entries)}


def report(document: dict, *, load=(), rare=(), attributive=(), schema=CONTRACT_SCHEMA):
    return profile.build_report(
        schema,
        document,
        contract_schema_path="info-tech-canon/schema.json",
        declaration_path="source/cadence.yaml",
        load_bearing=set(load),
        rare_load_bearing=set(rare),
        attributive=set(attributive),
    )


def codes(result: dict) -> set[str]:
    return {item["code"] for item in result["findings"]}


def test_valid_rare_load_bearing_requires_both_positive_controls() -> None:
    result = report(declaration(rare_entry()), rare={"audit.deny"})

    assert result["contract_valid"] is True
    assert result["conformant"] is True
    assert result["findings"] == []


def test_contract_validation_runs_before_profile() -> None:
    result = report({"source": "example"}, rare={"audit.deny"})

    assert result["contract_valid"] is False
    assert codes(result) == {"contract-validation-failed"}
    assert "load-bearing-cadence-missing" not in codes(result)


def test_missing_and_mismatched_source_inventory_classes_fail() -> None:
    wrong = rare_entry()
    wrong["extensions"]["netkingdom"]["evidence_class"] = "attributive"

    missing = report(declaration(), load={"audit.deny"})
    mismatched = report(declaration(wrong), rare={"audit.deny"})

    assert "load-bearing-cadence-missing" in codes(missing)
    assert "evidence-class-mismatch" in codes(mismatched)
    assert not missing["conformant"]
    assert not mismatched["conformant"]


def test_rare_rate_form_is_rejected_but_not_inferred_from_event_name() -> None:
    rate = {
        "source_id": "example.audit.deny",
        "event_class": "audit.deny",
        "extensions": {
            "netkingdom": {
                "evidence_class": "load-bearing",
                "rate_monitoring": "forbidden",
            }
        },
        "form": "expected-rate",
        "window": "24h",
        "expected_min": 1,
        "drop_below": "finding",
    }

    del rate["extensions"]["netkingdom"]["rate_monitoring"]
    explicit_rare = report(declaration(rate), rare={"audit.deny"})
    source_says_volume = report(declaration(rate), load={"audit.deny"})

    assert "rare-form-invalid" in codes(explicit_rare)
    assert "rare-rate-monitoring-not-forbidden" in codes(explicit_rare)
    assert explicit_rare["conformant"] is False
    assert source_says_volume["conformant"] is True


def test_rare_class_requires_heartbeat_and_reconciliation() -> None:
    item = rare_entry()
    del item["heartbeat"]
    item["reconciliation"] = {"divergence": "ignored"}

    result = report(declaration(item), rare={"audit.deny"})

    assert {
        "rare-heartbeat-missing",
        "rare-reconciliation-missing",
        "reconciliation-divergence-not-finding",
    } <= codes(result)


def test_attributive_coverage_is_advisory_by_default() -> None:
    result = report(declaration(), attributive={"audit.allow"})

    assert result["conformant"] is True
    assert result["summary"] == {"must": 0, "should": 1}
    assert codes(result) == {"attributive-cadence-missing"}


def test_duplicate_event_classes_and_inventory_conflict_fail() -> None:
    result = report(
        declaration(rare_entry(), copy.deepcopy(rare_entry())),
        rare={"audit.deny"},
        attributive={"audit.deny"},
    )

    assert "duplicate-event-class" in codes(result)
    assert "inventory-class-conflict" in codes(result)
    assert result["conformant"] is False


def test_expected_rate_load_bearing_has_positive_threshold_and_finding() -> None:
    rate = {
        "source_id": "example.audit.decision",
        "event_class": "audit.decision",
        "extensions": {
            "netkingdom": {
                "evidence_class": "load-bearing",
                "rate_monitoring": "forbidden",
            }
        },
        "form": "expected-rate",
        "window_seconds": 0,
        "expected_min": 0,
        "drop_below": "log",
    }

    result = report(declaration(rate), load={"audit.decision"})

    assert {
        "rate-window-invalid",
        "expected-min-invalid",
        "rate-drop-not-finding",
    } <= codes(result)


# Integration uses the owner artifact directly; never vendor a generic schema.
UPSTREAM = pathlib.Path(__file__).resolve().parents[4] / "info-tech-canon"
SCHEMA_PATH = UPSTREAM / "infospace/schemas/emission-cadence.schema.yaml"


@pytest.fixture
def upstream_schema():
    if not SCHEMA_PATH.is_file():
        pytest.skip("InfoTechCanon checkout required for contract integration")
    return yaml.safe_load(SCHEMA_PATH.read_text())


def canonical_document():
    document = declaration(rare_entry())
    document["declaration_id"] = "example.audit"
    return document


def test_published_contract_and_namespaced_overlay(upstream_schema):
    document = canonical_document()
    assert report(document, rare={"audit.deny"}, schema=upstream_schema)["conformant"]
    document["sources"][0]["evidence_class"] = "load-bearing"
    assert not report(document, rare={"audit.deny"}, schema=upstream_schema)[
        "contract_valid"
    ]


def test_published_contract_does_not_substitute_for_profile(upstream_schema):
    document = canonical_document()
    del document["sources"][0]["reconciliation"]
    result = report(document, rare={"audit.deny"}, schema=upstream_schema)
    assert result["contract_valid"]
    assert "rare-reconciliation-missing" in codes(result)
    assert not result["conformant"]


def test_duplicate_source_ids_fail_even_with_distinct_event_classes(upstream_schema):
    document = canonical_document()
    other = copy.deepcopy(document["sources"][0])
    other["event_class"] = "audit.revocation"
    document["sources"].append(other)
    result = report(
        document, rare={"audit.deny", "audit.revocation"}, schema=upstream_schema
    )
    assert result["contract_valid"]
    assert "duplicate-source-id" in codes(result)
    assert not result["conformant"]


def test_should_policy_and_cli(tmp_path, capsys):
    schema = tmp_path / "schema.json"
    document = tmp_path / "declaration.yaml"
    import json

    schema.write_text(json.dumps(CONTRACT_SCHEMA))
    document.write_text(json.dumps(declaration()))
    args = [
        str(document),
        "--contract-schema",
        str(schema),
        "--attributive",
        "audit.allow",
    ]
    assert profile.main(args) == 0
    assert profile.main(args + ["--fail-on-should"]) == 1
    schema.write_text('{"type": "invalid"}')
    assert profile.main(args) == 1
    assert "contract-schema-invalid" in capsys.readouterr().out


@pytest.mark.parametrize("window", ["PT0S", "P0D", "PT00H00M00S"])
def test_published_contract_zero_duration_is_not_a_positive_profile_window(
    upstream_schema, window
):
    document = canonical_document()
    entry = document["sources"][0]
    entry.pop("heartbeat")
    entry.pop("reconciliation")
    entry.update(
        form="expected-rate", window=window, expected_min=1, drop_below="finding"
    )
    result = report(document, load={"audit.deny"}, schema=upstream_schema)
    assert result["contract_valid"]
    assert "rate-window-invalid" in codes(result)
    assert not result["conformant"]