import struct
from pathlib import Path

import yaml
from django.conf import settings

ROOT = Path(__file__).resolve().parents[2]


def test_only_web_runs_migrations_in_compose() -> None:
    compose = yaml.safe_load((ROOT / "docker-compose.yml").read_text(encoding="utf-8"))
    services = compose["services"]

    assert services["web"].get("environment", {}).get("VACATURERADAR_RUN_MIGRATIONS", "1") == "1"
    assert services["worker"]["environment"]["VACATURERADAR_RUN_MIGRATIONS"] == "0"
    assert services["scheduler"]["environment"]["VACATURERADAR_RUN_MIGRATIONS"] == "0"


def test_unraid_uses_one_dockerman_container_with_ui_metadata() -> None:
    compose = yaml.safe_load((ROOT / "docker-compose.unraid.yml").read_text(encoding="utf-8"))

    assert list(compose["services"]) == ["app"]
    labels = compose["services"]["app"]["labels"]
    assert labels["net.unraid.docker.managed"] == "dockerman"
    assert labels["net.unraid.docker.webui"] == "http://[IP]:[PORT:8080]/"
    assert (
        labels["net.unraid.docker.icon"]
        == "http://127.0.0.1:1226/static/img/vacatureradar-docker.png"
    )
    assert "[IP]" not in labels["net.unraid.docker.icon"]
    assert "[PORT:" not in labels["net.unraid.docker.icon"]

    icon = ROOT / "static" / "img" / "vacatureradar-docker.png"
    payload = icon.read_bytes()
    assert payload.startswith(b"\x89PNG\r\n\x1a\n")
    assert struct.unpack(">II", payload[16:24]) == (256, 256)

    dockerfile = (ROOT / "Dockerfile.unraid").read_text(encoding="utf-8")
    entrypoint = (ROOT / "scripts" / "unraid_aio_entrypoint.sh").read_text(encoding="utf-8")
    assert "python:3.13-slim-trixie" in dockerfile
    assert "DJANGO_DEBUG=0" in dockerfile
    assert "PUBLIC_BASE_URL=https://build.invalid" in dockerfile
    assert "postgres-aio17" in entrypoint
    assert "pg_config --bindir" in entrypoint


def test_runtime_is_compatible_with_read_only_container() -> None:
    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
    deploy_script = (ROOT / "scripts" / "deploy_docker.sh").read_text(encoding="utf-8")

    assert '"--no-control-socket"' in dockerfile
    assert "DJANGO_DEBUG=0" in dockerfile
    assert "PUBLIC_BASE_URL=https://build.invalid" in dockerfile
    assert "exec -T web python manage.py collectstatic" not in deploy_script
    assert "for required_host in 127.0.0.1 localhost" in deploy_script


def test_celery_default_queue_is_consumed_by_worker() -> None:
    compose = yaml.safe_load((ROOT / "docker-compose.yml").read_text(encoding="utf-8"))
    worker_command = compose["services"]["worker"]["command"]

    assert settings.CELERY_TASK_DEFAULT_QUEUE == "default"
    queue_index = worker_command.index("-Q") + 1
    assert "default" in worker_command[queue_index].split(",")


def test_deployment_examples_use_per_platform_mailbox_configuration() -> None:
    required_keys = {
        "MAILBOX_CREDENTIAL_KEYS",
        "IMAP_CONNECT_TIMEOUT_SECONDS",
        "IMAP_MAX_MESSAGES_PER_POLL",
        "IMAP_MAX_MESSAGE_BYTES",
    }
    for filename in (".env.example", "scripts/codex_bootstrap.sh", "scripts/release_verify.sh"):
        content = (ROOT / filename).read_text(encoding="utf-8")

        assert "IMAP_ENABLED" not in content
        for key in required_keys:
            assert f"{key}=" in content

    env_example = (ROOT / ".env.example").read_text(encoding="utf-8")
    assert "VACATURERADAR_OWNER_NAME=Jens" in env_example


def test_unraid_deploy_requires_dedicated_ssh_alias() -> None:
    deploy_script = (ROOT / "scripts" / "deploy_unraid.sh").read_text(encoding="utf-8")

    assert "UNRAID_SSH_HOST:-unraid-itworx" in deploy_script
    assert "ssh -G" in deploy_script
    assert '[[ "$ssh_user" != "root" ]]' in deploy_script
    assert "itworx_unraid_deploy" in deploy_script
    assert "BatchMode=yes" in deploy_script
    assert "git ls-files --cached --others --exclude-standard -z" in deploy_script
    assert '[[ -e "$tracked_path" ]]' in deploy_script
    assert "/health/ready/" in deploy_script


def test_public_https_origin_uses_external_port_not_internal_app_port() -> None:
    deploy_script = (ROOT / "scripts" / "deploy_docker.sh").read_text(encoding="utf-8")
    assert 'app_public_port="${APP_PUBLIC_PORT:-}"' in deploy_script
    assert 'app_public_port="443"' in deploy_script
    assert 'write_env "PUBLIC_BASE_URL" "$app_base_url" 1' in deploy_script
    assert "https://$app_host:$app_port" not in deploy_script


def test_health_endpoints_are_exempt_from_internal_https_redirect() -> None:
    assert r"^health/(?:live|ready)/$" in settings.SECURE_REDIRECT_EXEMPT


def test_unraid_uses_dedicated_shared_cache_database() -> None:
    compose = yaml.safe_load((ROOT / "docker-compose.unraid.yml").read_text(encoding="utf-8"))
    environment = compose["services"]["app"]["environment"]
    assert environment["CACHE_URL"] == "redis://127.0.0.1:6379/1"
    assert environment["HEALTHCHECK_REQUIRE_CACHE"] == "1"


def test_unraid_database_url_is_built_inside_the_container() -> None:
    compose = yaml.safe_load((ROOT / "docker-compose.unraid.yml").read_text(encoding="utf-8"))
    environment = compose["services"]["app"]["environment"]
    assert "DATABASE_URL" not in environment


def test_deploy_uses_selected_environment_file_for_compose() -> None:
    compose = yaml.safe_load((ROOT / "docker-compose.yml").read_text(encoding="utf-8"))
    deploy_script = (ROOT / "scripts" / "deploy_docker.sh").read_text(encoding="utf-8")

    assert compose["x-app"]["env_file"] == ["${VACATURERADAR_ENV_FILE:-.env}"]
    assert 'export VACATURERADAR_ENV_FILE="$env_file"' in deploy_script
    assert 'docker compose --env-file "$env_file" -f "$compose_file" up -d --build' in deploy_script
    assert "waarde uit ${env_file}" in deploy_script


def test_release_uv_install_is_immutable_and_does_not_require_github_api() -> None:
    workflow = (ROOT / ".gitea" / "workflows" / "release.yml").read_text(encoding="utf-8")

    assert "astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0" in workflow
    assert 'version: "0.11.12"' in workflow
    assert "astral-sh/setup-uv@v6" not in workflow