from __future__ import annotations

import hashlib
import sys
from pathlib import Path

from scripts import publish_release_bundle as publisher

ROOT = Path(__file__).resolve().parents[1]
LOCAL_TMP = ROOT / "tmp" / "pytest-publish-release"


def _write_tarball_placeholder(name: str, content: bytes = b"release") -> tuple[Path, str]:
    LOCAL_TMP.mkdir(parents=True, exist_ok=True)
    path = LOCAL_TMP / f"{name}.tar.gz"
    path.write_bytes(content)
    return path, hashlib.sha256(content).hexdigest()


def test_default_mode_uploads_and_runs_preflight_only(monkeypatch):
    tarball, sha256 = _write_tarball_placeholder("default")
    calls: list[list[str]] = []

    monkeypatch.setattr(publisher, "run", lambda cmd, dry_run=False: calls.append(cmd))
    monkeypatch.setattr(
        sys,
        "argv",
        [
            "publish_release_bundle.py",
            "--remote",
            "nexus",
            "--tarball",
            str(tarball),
            "--sha256",
            sha256,
        ],
    )

    assert publisher.main() == 0

    assert len(calls) == 3
    assert calls[0][:1] == ["scp"]
    assert calls[0][-1] == "nexus:/tmp/nexus-release-20260708.tar.gz"
    assert calls[1][:2] == ["ssh", "nexus"]
    assert "tar xzf /tmp/nexus-release-20260708.tar.gz -C /tmp" in calls[1][-1]
    assert calls[2][:2] == ["ssh", "nexus"]
    assert "bash /tmp/nexus-release/deploy/preflight-release-host.sh" in calls[2][-1]
    assert "apply-release-bundle.sh" not in calls[2][-1]
    assert "\\tmp\\" not in calls[1][-1]
    assert "\\tmp\\" not in calls[2][-1]


def test_apply_mode_runs_apply_after_preflight(monkeypatch):
    tarball, sha256 = _write_tarball_placeholder("apply")
    calls: list[list[str]] = []

    monkeypatch.setattr(publisher, "run", lambda cmd, dry_run=False: calls.append(cmd))
    monkeypatch.setattr(
        sys,
        "argv",
        [
            "publish_release_bundle.py",
            "--remote",
            "root@example.test",
            "--tarball",
            str(tarball),
            "--sha256",
            sha256,
            "--identity-file",
            str(LOCAL_TMP / "id.pem"),
            "--ssh-option",
            "StrictHostKeyChecking=no",
            "--apply",
        ],
    )

    assert publisher.main() == 0

    assert len(calls) == 4
    assert calls[0][:5] == ["scp", "-i", str(LOCAL_TMP / "id.pem"), "-o", "StrictHostKeyChecking=no"]
    assert calls[1][:6] == ["ssh", "-i", str(LOCAL_TMP / "id.pem"), "-o", "StrictHostKeyChecking=no", "root@example.test"]
    assert "bash /tmp/nexus-release/deploy/preflight-release-host.sh" in calls[2][-1]
    assert "sudo bash /tmp/nexus-release/deploy/apply-release-bundle.sh" in calls[3][-1]


def test_no_upload_dry_run_keeps_apply_disabled(monkeypatch):
    tarball, sha256 = _write_tarball_placeholder("no-upload")
    calls: list[list[str]] = []

    monkeypatch.setattr(publisher, "run", lambda cmd, dry_run=False: calls.append(cmd))
    monkeypatch.setattr(
        sys,
        "argv",
        [
            "publish_release_bundle.py",
            "--remote",
            "nexus",
            "--tarball",
            str(tarball),
            "--sha256",
            sha256,
            "--no-upload",
            "--dry-run",
        ],
    )

    assert publisher.main() == 0

    assert len(calls) == 2
    assert all(call[0] == "ssh" for call in calls)
    assert all("sudo bash" not in call[-1] for call in calls)
    assert all("\\tmp\\" not in call[-1] for call in calls)


def test_sha256_mismatch_fails_before_remote_commands(monkeypatch):
    tarball, _sha256 = _write_tarball_placeholder("mismatch")
    calls: list[list[str]] = []

    monkeypatch.setattr(publisher, "run", lambda cmd, dry_run=False: calls.append(cmd))
    monkeypatch.setattr(
        sys,
        "argv",
        [
            "publish_release_bundle.py",
            "--remote",
            "nexus",
            "--tarball",
            str(tarball),
            "--sha256",
            "0" * 64,
        ],
    )

    assert publisher.main() == 2
    assert calls == []


def test_remote_join_always_uses_posix_separator():
    assert publisher.remote_join("/tmp", "nexus-release/deploy/apply-release-bundle.sh") == (
        "/tmp/nexus-release/deploy/apply-release-bundle.sh"
    )