from pathlib import Path

from fastapi.testclient import TestClient

from app.main import app


ROOT = Path(__file__).parents[2]


def test_valid_request_id_is_returned() -> None:
    response = TestClient(app).get("/health/live", headers={"x-request-id": "rc3-check.123"})

    assert response.status_code == 200
    assert response.headers["x-request-id"] == "rc3-check.123"


def test_unsafe_request_id_is_replaced() -> None:
    response = TestClient(app).get("/health/live", headers={"x-request-id": "unsafe request/id"})

    assert response.status_code == 200
    assert response.headers["x-request-id"] != "unsafe request/id"
    assert " " not in response.headers["x-request-id"]


def test_runtime_report_is_read_only_by_default_and_requires_confirmation() -> None:
    source = (ROOT / "scripts" / "runtime_state_report.py").read_text(encoding="utf-8")
    dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")

    assert '"mode": "read_only"' in source
    assert 'IMPORT_ROOT = ROOT if (ROOT / "app").is_dir() else BACKEND' in source
    assert "if args.reconcile and args.confirm != RECONCILE_CONFIRMATION" in source
    assert "RuntimeReconciliationService.reconcile(db)" in source
    assert "COPY scripts/runtime_state_report.py /app/scripts/runtime_state_report.py" in dockerfile


def test_all_in_one_deploy_embeds_immutable_build_identity() -> None:
    dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
    release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
    deploy_powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
    deploy_shell = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")

    assert "ARG GEOINTEL_BUILD_SHA=unknown" in dockerfile
    assert 'GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}"' in dockerfile
    assert 'GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"' in dockerfile
    assert 'org.opencontainers.image.revision="${GEOINTEL_BUILD_SHA}"' in dockerfile
    # However it is factored, the build SHA must come from git HEAD.
    assert "git rev-parse HEAD" in release_script
    assert "GEOINTEL_BUILD_SHA" in release_script
    assert "--build-arg GEOINTEL_BUILD_SHA=" in release_script
    assert "--build-arg GEOINTEL_BUILD_TIME=" in release_script
    for deploy_source in (deploy_powershell, deploy_shell):
        assert "bash deploy/unraid/deploy-release.sh" in deploy_source