#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Integration test for deterministic artifact generation and verification."""

from __future__ import annotations

import argparse
import hashlib
import json
import subprocess
import sys
import tempfile
from pathlib import Path


def expect_verification_failure(command: list[str], description: str) -> None:
    result = subprocess.run(command, check=False, capture_output=True, text=True)
    if result.returncode == 0:
        raise RuntimeError(f"verification unexpectedly accepted {description}")


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()

    with tempfile.TemporaryDirectory() as directory:
        temporary = Path(directory)
        artifact = temporary / "test.elf"
        manifest = temporary / "test.json"
        payload = b"chimera-gfx-test-artifact\n"
        artifact.write_bytes(payload)
        subprocess.run(
            [
                sys.executable,
                str(root / "tools/generate_artifact_manifest.py"),
                "--artifact",
                str(artifact),
                "--output",
                str(manifest),
                "--id",
                "manifest-tool-test",
                "--version",
                "1",
                "--source-repository",
                "test://chimera-gfx",
                "--source-commit",
                "0" * 40,
                "--target",
                "test",
                "--profile",
                "unit-test",
            ],
            check=True,
        )
        document = json.loads(manifest.read_text(encoding="utf-8"))
        if document["artifact"]["sha256"] != hashlib.sha256(payload).hexdigest():
            raise RuntimeError("generated digest differs from expected digest")
        if document["execution"].get("execution_eligible") is not False:
            raise RuntimeError("new artifacts must default to execution-ineligible")
        verify_command = [
            sys.executable,
            str(root / "tools/verify_artifact_manifest.py"),
            "--manifest",
            str(manifest),
            "--artifact",
            str(artifact),
        ]
        subprocess.run(verify_command, check=True)

        artifact.write_bytes(payload + b"changed")
        expect_verification_failure(verify_command, "changed artifact bytes")
        artifact.write_bytes(payload)

        document["execution"]["authorized"] = True
        manifest.write_text(
            json.dumps(document, indent=2, sort_keys=True) + "\n", encoding="utf-8"
        )
        expect_verification_failure(verify_command, "execution authority")

        document["execution"]["authorized"] = False
        del document["execution"]["execution_eligible"]
        manifest.write_text(
            json.dumps(document, indent=2, sort_keys=True) + "\n", encoding="utf-8"
        )
        expect_verification_failure(verify_command, "missing execution eligibility")
    print("artifact manifest generation and verification passed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())