"""Synthetic owner config/key; no native custody, provider or queue call."""

from dataclasses import replace
import json
import os
from pathlib import Path
from types import SimpleNamespace
from unittest.mock import MagicMock

import pytest

from glas_harness.contract import ExecutionLimits, OperationalReadiness
from glas_harness.profiles import ProfileCatalog
from llm_connect.messages_gate import MessagesPolicy
from sandboxer.extensions.runtime import runtime_digest
from rein_aharness.claim_loop import ProcessResult
from rein_aharness.owner_bootstrap import BootstrapRefused, prepare, run_once
from rein_aharness.request_admission import RequestLedger
from rein_aharness.spend_admission import SpendLedger, digest
from test_spend_admission import ledger as ledger, configured


@pytest.fixture
def prepared(ledger, tmp_path, monkeypatch):
    catalog = ProfileCatalog()
    profile, descriptor = catalog.resolve("harness.agent-dev-local@1.0.0")
    profile = profile.model_copy(update={
        "sandbox_profile": "profile.bwrap-local", "credential_route_refs": [],
        "limits": ExecutionLimits(max_budget_usd=4.0, max_turns=8),
        "operational_readiness": OperationalReadiness(status="ready", reason="fixture only",
                                                     owner="tests", evidence_ref="test:bootstrap"),
    })
    catalog.profiles()[(profile.id, profile.version)] = profile
    monkeypatch.setattr("glas_harness.profiles.ProfileCatalog", lambda: catalog)
    policy = replace(ledger.policy, profile_ref=str(profile.ref),
                     profile_sha256=digest(profile.model_dump(mode="json")),
                     descriptor_sha256=digest(descriptor.model_dump(mode="json")))
    parent = SpendLedger(ledger.path.parent / "prepared.sqlite3", policy)
    parent.initialize()
    RequestLedger(parent).initialize()
    config = configured(parent)
    runtime = tmp_path / "runtime"
    (runtime / "bin").mkdir(parents=True)
    (runtime / "bin/python3").write_bytes(b"not executed; fixture runtime structure")
    (runtime / "pyvenv.cfg").write_text("fixture only")
    messages = MessagesPolicy("fixture:upper-rate", profile.model.model, 1000, 1000, 1000, 1000)
    data = {"version": "1", "authority_ref": policy.authority_ref,
            "spend_policy_sha256": policy.sha256, "messages_policy": messages.__dict__,
            "runtime": {"path": str(runtime), "sha256": runtime_digest(runtime)}}
    path = parent.path.parent / "owner.json"
    path.write_text(json.dumps(data)); path.chmod(0o600)
    monkeypatch.setattr("rein_aharness.owner_bootstrap.OpsRunConfig.from_env", lambda: config)
    return path, config, data, runtime


def test_prepare_pins_without_key_or_claim(prepared, monkeypatch):
    path, config, data, runtime = prepared
    monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
    policy, selected, checksum = prepare(path, config)
    assert selected == runtime and checksum == data["runtime"]["sha256"]
    assert policy.model == data["messages_policy"]["model"]


@pytest.mark.parametrize("case", ["authority", "policy_digest", "model", "version", "unknown_field",
                                  "duplicate", "public", "runtime_changed", "schema_missing"])
def test_bad_bootstrap_refuses_before_claim(prepared, monkeypatch, capsys, case):
    path, config, data, runtime = prepared
    if case == "authority": data["authority_ref"] = "unrelated"
    elif case == "policy_digest": data["spend_policy_sha256"] = "0" * 64
    elif case == "model": data["messages_policy"]["model"] = "unadmitted"
    elif case == "version": data["version"] = "2"
    elif case == "unknown_field": data["upstream_url"] = "https://not-admitted.invalid"
    elif case == "runtime_changed": (runtime / "added-file").write_text("changed")
    elif case == "schema_missing":
        import sqlite3
        with sqlite3.connect(config.spend_ledger_path) as db: db.execute("DROP TABLE request_routes")
    path.write_text(json.dumps(data))
    if case == "duplicate": path.write_text(path.read_text().replace('"version": "1"', '"version": "1", "version": "1"'))
    if case == "public": path.chmod(0o644)
    claimant = MagicMock()
    monkeypatch.setattr("rein_aharness.claim_loop.process_one", claimant)
    monkeypatch.setenv("ANTHROPIC_API_KEY", "fixture-owner-key")
    assert run_once(path) == 2
    claimant.assert_not_called()
    assert "fixture-owner-key" not in capsys.readouterr().out
    assert "ANTHROPIC_API_KEY" not in os.environ


@pytest.mark.parametrize("check,key,alternate,code", [
    (True, None, None, 0), (False, None, None, 2),
    (False, "fixture-key", "alternate-token", 2), (False, "invalid key", None, 2),
])
def test_check_and_missing_or_mixed_auth_never_claim(prepared, monkeypatch, check, key, alternate, code):
    path, _, _, _ = prepared
    for name, value in [("ANTHROPIC_API_KEY", key), ("ANTHROPIC_AUTH_TOKEN", alternate)]:
        if value is None: monkeypatch.delenv(name, raising=False)
        else: monkeypatch.setenv(name, value)
    claimant = MagicMock()
    monkeypatch.setattr("rein_aharness.claim_loop.process_one", claimant)
    assert run_once(path, check_only=check) == code
    claimant.assert_not_called()


@pytest.mark.parametrize("result,code", [
    (ProcessResult(claimed=False, empty=True), 0),
    (ProcessResult(claimed=True, ok=True, run_id="fixture-run"), 0),
    (ProcessResult(claimed=False, ok=False, reason="private exception"), 1),
    (ProcessResult(claimed=True, ok=False, reason="private prompt"), 1),
])
def test_exactly_one_cycle_without_key_in_environment(prepared, monkeypatch, capsys, result, code):
    path, config, data, runtime = prepared
    monkeypatch.setenv("ANTHROPIC_API_KEY", "fixture-key")
    monkeypatch.delenv("ANTHROPIC_AUTH_TOKEN", raising=False)
    monkeypatch.setattr("rein_aharness.readiness.run_readiness_checks", lambda client: SimpleNamespace(ok=True))
    seen = []
    def process(client, **kwargs):
        assert client.config is config
        assert config.require_request_admission and config.require_spend_admission
        assert config.messages_owner is not None
        assert "ANTHROPIC_API_KEY" not in os.environ
        seen.append(client)
        return result
    monkeypatch.setattr("rein_aharness.claim_loop.process_one", process)
    assert run_once(path, report_to_hub=False) == code
    output = capsys.readouterr().out
    assert len(seen) == 1 and "fixture-key" not in output and "private" not in output


def test_unexpected_exception_is_bounded(prepared, monkeypatch, capsys):
    path, _, _, _ = prepared
    monkeypatch.setenv("ANTHROPIC_API_KEY", "fixture-key")
    monkeypatch.delenv("ANTHROPIC_AUTH_TOKEN", raising=False)
    monkeypatch.setattr("rein_aharness.readiness.run_readiness_checks", lambda client: SimpleNamespace(ok=True))
    monkeypatch.setattr("rein_aharness.claim_loop.process_one", MagicMock(side_effect=RuntimeError("fixture-key")))
    assert run_once(path) == 1
    assert json.loads(capsys.readouterr().out) == {"ok": False, "code": "owner_cycle_failed"}