import copy
import hashlib
import importlib.util
import os
import shutil
import subprocess
import sys
import tempfile
import unittest
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
SPEC = importlib.util.spec_from_file_location("check", ROOT / "scripts/check.py")
check = importlib.util.module_from_spec(SPEC)
SPEC.loader.exec_module(check)


class PublicationChecks(unittest.TestCase):
    def test_current_documents(self):
        self.assertTrue(check.check(ROOT)["offline_only"])

    def test_rejects_duplicate_and_nonfinite_json(self):
        with tempfile.TemporaryDirectory() as directory:
            file = Path(directory) / "input.json"
            for value in ('{"x":1,"x":2}', '{"x":NaN}', '[]'):
                file.write_text(value)
                with self.assertRaises(ValueError):
                    check.load(file)

    def test_rejects_false_green_and_wrong_repository_evidence(self):
        data = check.load(ROOT / "status.json")
        evidence = check.load(ROOT / data["evidence_path"])
        for field, value in (("conclusion", "failure"), ("url", "https://example.invalid/run/1")):
            invalid = copy.deepcopy(data)
            invalid["repositories"][0]["checks"][0][field] = value
            with self.assertRaises(ValueError):
                check.snapshot(invalid, evidence)

    def test_renamed_repositories_link_by_their_github_names(self):
        data = check.load(ROOT / "status.json")
        evidence = check.load(ROOT / data["evidence_path"])
        renamed = [r for r in data["repositories"] if r["name"] in check.GITHUB_NAMES]
        self.assertTrue(renamed, "the snapshot lists renamed repositories")
        for repo in renamed:
            self.assertEqual("https://github.com/ta-amps/" + check.GITHUB_NAMES[repo["name"]], repo["url"])
            invalid = copy.deepcopy(data)
            next(r for r in invalid["repositories"] if r["name"] == repo["name"])["url"] = (
                "https://github.com/ta-amps/" + repo["name"])
            with self.assertRaises(ValueError):
                check.snapshot(invalid, evidence)

    def test_rejects_mutable_revision_and_inconsistent_counts(self):
        data = check.load(ROOT / "status.json")
        evidence = check.load(ROOT / data["evidence_path"])
        for revision in ("main", "abc123"):
            invalid = copy.deepcopy(data)
            invalid["repositories"][0]["main_revision"] = revision
            with self.assertRaises(ValueError):
                check.snapshot(invalid, evidence)
        data["summary"]["merged_pull_requests"] += 1
        with self.assertRaises(ValueError):
            check.snapshot(data, evidence)

    def test_blocks_broken_and_escaping_links(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            file = root / "guide.md"
            for link in ("missing.md", "../outside.md", "%2e%2e/outside.md"):
                file.write_text("[reference](" + link + ")")
                with self.assertRaises(ValueError):
                    check.local_links(file, root)

    def test_blocks_common_credentials_without_real_secrets(self):
        for prefix in ("ghp_", "tan_", "tsk_", "hmk_"):
            with self.assertRaises(ValueError):
                check.public_text(prefix + "z" * 40)
        with self.assertRaises(ValueError):
            check.public_text("https://" + "user:password@" + "example.invalid")

    def test_architecture_rejects_competing_work_authority_and_hidden_fallback(self):
        baseline = check.load(ROOT / "architecture.json")
        names = {r["name"] for r in check.load(ROOT / "status.json")["repositories"]}
        invalid = copy.deepcopy(baseline)
        invalid["implicit_server_fallback"] = True
        with self.assertRaisesRegex(ValueError, "reasoning belongs in workers"):
            check.architecture(invalid, names, ROOT)
        invalid = copy.deepcopy(baseline)
        next(r for r in invalid["repositories"] if r["role"] == "seed_pack")["role"] = "fabric"
        with self.assertRaisesRegex(ValueError, "must not own"):
            check.architecture(invalid, names, ROOT)

    def test_architecture_rejects_incomplete_inventory_and_management_inference(self):
        baseline = check.load(ROOT / "architecture.json")
        names = {r["name"] for r in check.load(ROOT / "status.json")["repositories"]}
        invalid = copy.deepcopy(baseline)
        invalid["repositories"].pop()
        with self.assertRaisesRegex(ValueError, "classify every"):
            check.architecture(invalid, names, ROOT)
        invalid = copy.deepcopy(baseline)
        next(e for e in invalid["server_exceptions"] if e["id"] == "management")["reasoning"] = True
        with self.assertRaisesRegex(ValueError, "blanket inference"):
            check.architecture(invalid, names, ROOT)
        for field in ("payer", "model", "destination"):
            invalid = copy.deepcopy(baseline)
            next(e for e in invalid["server_exceptions"] if e["id"] == "explicit_inference")["required_record"].remove(field)
            with self.assertRaisesRegex(ValueError, "record authority"):
                check.architecture(invalid, names, ROOT)

    def test_architecture_rejects_extra_primitives_and_pack_authority(self):
        baseline = check.load(ROOT / "architecture.json")
        names = {r["name"] for r in check.load(ROOT / "status.json")["repositories"]}
        for field, value in (("core_entities", ["noun", "verb", "project"]),
                             ("project_is_primitive", True),
                             ("seed_pack_contents", ["noun", "verb", "autonomous_service"])):
            invalid = copy.deepcopy(baseline)
            invalid[field] = value
            with self.assertRaises(ValueError):
                check.architecture(invalid, names, ROOT)

    def test_architecture_has_two_surfaces_and_unnamed_packs(self):
        baseline = check.load(ROOT / "architecture.json")
        names = {r["name"] for r in check.load(ROOT / "status.json")["repositories"]}
        check.architecture(baseline, names, ROOT)
        for field, value in (("public_surfaces", ["eranos", "agora", "home"]),
                             ("public_surfaces", ["eranos"]),
                             ("infrastructure", ["tessera"])):
            invalid = copy.deepcopy(baseline)
            invalid[field] = value
            with self.assertRaisesRegex(ValueError, "exactly two public surfaces"):
                check.architecture(invalid, names, ROOT)
        invalid = copy.deepcopy(baseline)
        next(r for r in invalid["repositories"] if r["role"] == "seed_pack")["role"] = "surface"
        with self.assertRaisesRegex(ValueError, "never a surface"):
            check.architecture(invalid, names, ROOT)
        invalid = copy.deepcopy(baseline)
        next(r for r in invalid["repositories"] if r["name"] == "herma")["role"] = "authoring_kit"
        with self.assertRaisesRegex(ValueError, "only Tessera and Herma"):
            check.architecture(invalid, names, ROOT)
        retired = [r for r in baseline["repositories"] if check.retired_names(r["name"])]
        self.assertTrue(retired, "the inventory still lists the older pack repositories")
        for repo in retired:
            self.assertEqual("seed_pack", repo["role"])
        invalid = copy.deepcopy(baseline)
        next(r for r in invalid["repositories"] if check.retired_names(r["name"]))["role"] = "authoring_kit"
        with self.assertRaisesRegex(ValueError, "retired pack name"):
            check.architecture(invalid, names, ROOT)


# Frozen history: every deck version and the dated storyboards, pinned here as well as in the site's own manifests.
PUBLISHED = {"v1": "f82b276b2fde16f993c958845de56026a4a2ef50a655d616a93b7f8c377803e4",
             "v2": "5ebb6fefbd04ed37907d27ab2b07974d1b0e785eadd1bf9550daf05231a5ac02",
             "v3": "a2985302395e965631c44c7a7a18b340f3a8c2cc25fd69bd66f156cbd3a18bea",
             "v4": "1a68ed7af008f15368f37033142d05a69dab832f6f5f37e9530bff1d27a82bc9"}
FROZEN_DRAFTS = {"storyboards/2026-10-29/eranos-video-v1/": "33b0b50d733799e86291567c18a176a53193740675ef6db5c803e66570cdd1b5",
                 "storyboards/2026-10-29/two-videos/": "aae6a382379b94a13d2bb92cc0748dcb622f38b10aa811f8517b54b2787237fb"}


def page(path: Path, body: str) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text("<!doctype html><html><body>" + body + "</body></html>")


class SiteChecks(unittest.TestCase):
    def test_published_deck_versions_never_change(self):
        decks = check.load(ROOT / "site/decks.json")
        self.assertEqual(set(PUBLISHED), {version["version"] for version in decks["versions"]})
        for version in decks["versions"]:
            self.assertEqual(PUBLISHED[version["version"]], version["html_sha256"])
            data = (ROOT / "site" / version["path"] / "index.html").read_bytes()
            self.assertEqual(PUBLISHED[version["version"]], hashlib.sha256(data).hexdigest())

    def test_frozen_drafts_never_change(self):
        listing = check.load(ROOT / "site/content/earlier-drafts.json")
        pinned = {item["href"]: item["html_sha256"] for group in listing["groups"] for item in group["items"]
                  if "html_sha256" in item}
        self.assertEqual(FROZEN_DRAFTS, pinned)
        site = ROOT / "site"
        self.assertEqual({(site / href / "index.html").resolve() for href in pinned}, check.frozen_drafts(listing, site))
        with tempfile.TemporaryDirectory() as directory:
            copy = Path(directory)
            page(copy / "storyboards/2026-10-29/two-videos/index.html", "<p>edited</p>")
            page(copy / "storyboards/2026-10-29/eranos-video-v1/index.html", "<p>edited</p>")
            with self.assertRaisesRegex(ValueError, "frozen draft changed"):
                check.frozen_drafts(listing, copy)

    def test_frozen_pages_may_still_link_to_moved_pages_and_nothing_else(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            site = root / "site"
            page(site / "decks/index.html", '<h1 id="connect">Decks</h1>')
            page(site / "old/v1/index.html", '<a href="../../docs/connect/">Connect an agent</a>')
            listing = {"pages": [{"from": "docs/connect/", "to": "decks/#connect", "what": "Connect an agent"}]}
            pages = check.site_pages(site)
            moved = check.moved_pages(listing, site, pages)
            frozen = (site / "old/v1/index.html").resolve()
            check.site_links(frozen, site, pages, root, moved)
            with self.assertRaisesRegex(ValueError, "broken"):
                check.site_links(frozen, site, pages, root)
            page(site / "current.html", '<a href="docs/connect/">Connect an agent</a>')
            pages = check.site_pages(site)
            with self.assertRaisesRegex(ValueError, "broken"):
                check.site_links((site / "current.html").resolve(), site, pages, root, frozenset())
            page(site / "old/v1/index.html", '<a href="../../docs/never-existed/">Gone</a>')
            pages = check.site_pages(site)
            with self.assertRaisesRegex(ValueError, "broken"):
                check.site_links(frozen, site, pages, root, moved)

    def test_moved_pages_are_gone_and_point_to_a_page(self):
        with tempfile.TemporaryDirectory() as directory:
            site = Path(directory)
            page(site / "decks/index.html", '<h1 id="connect">Decks</h1>')
            pages = check.site_pages(site)
            for target, message in (("decks/#nowhere", "missing anchor"), ("missing/", "point to a page")):
                with self.assertRaisesRegex(ValueError, message):
                    check.moved_pages({"pages": [{"from": "docs/", "to": target, "what": "Docs"}]}, site, pages)
            page(site / "docs/index.html", "<p>Still here</p>")
            with self.assertRaisesRegex(ValueError, "must be gone"):
                check.moved_pages({"pages": [{"from": "docs/", "to": "decks/", "what": "Docs"}]}, site, check.site_pages(site))

    def test_the_real_moved_pages_resolve(self):
        site = ROOT / "site"
        listing = check.load(site / "content/moved.json")
        moved = check.moved_pages(listing, site, check.site_pages(site))
        self.assertIn((site / "docs/connect/index.html").resolve(), moved)
        self.assertIn((site / "docs/status/index.html").resolve(), moved)

    def test_current_decks_need_their_source_slides_and_pdf(self):
        decks = check.load(ROOT / "site/decks.json")
        site = ROOT / "site"
        self.assertEqual(5, len(decks["decks"]))
        frozen = {(site / v["path"] / "index.html").resolve() for v in decks["versions"]}
        for deck in decks["decks"]:
            self.assertEqual(1, len(check.current_deck(deck, site, frozen)))
            for field, value, message in (("downloads", [], "needs its PDF"), ("slides", deck["slides"] + 1, "slide count"),
                                          ("source", "decks/nowhere/", "needs its source"),
                                          ("path", "decks/2026-10-29/v4/", "frozen version")):
                with self.assertRaisesRegex(ValueError, message):
                    check.current_deck(dict(deck, **{field: value}), site, frozen)

    def test_site_links_must_resolve_inside_the_site(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            site = root / "site"
            page(site / "index.html", '<a href="docs/">Docs</a><a href="/docs/#top">Top</a><p id="here"></p>')
            page(site / "docs/index.html", '<h1 id="top">Docs</h1><a href="../#here">Back</a>')
            pages = check.site_pages(site)
            for path in pages:
                check.site_links(path, site, pages, root)
            for body in ('<a href="missing/">x</a>', '<a href="../outside.html">x</a>', '<a href="#nowhere">x</a>',
                         '<a href="docs/#nowhere">x</a>', '<a href="/elsewhere/">x</a>', '<a href="/../outside.html">x</a>'):
                page(site / "bad.html", body)
                pages = check.site_pages(site)
                with self.assertRaises(ValueError):
                    check.site_links(site / "bad.html", site, pages, root)

    def test_issue_form_links_need_their_form(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            site = root / "site"
            link = '<a href="https://github.com/ta-amps/agora-public-overview-architecture-setup-and-contribution/issues/new?template=feedback.yml">Feedback</a>'
            page(site / "index.html", link)
            pages = check.site_pages(site)
            with self.assertRaises(ValueError):
                check.site_links(site / "index.html", site, pages, root)
            (root / ".github/ISSUE_TEMPLATE").mkdir(parents=True)
            (root / ".github/ISSUE_TEMPLATE/feedback.yml").write_text("name: Feedback\n")
            check.site_links(site / "index.html", site, pages, root)

    def test_site_downloads_are_hash_checked(self):
        with tempfile.TemporaryDirectory() as directory:
            site = Path(directory)
            data = b"%PDF-1.7 synthetic"
            (site / "deck.pdf").write_bytes(data)
            entry = {"format": "pdf", "path": "deck.pdf", "sha256": hashlib.sha256(data).hexdigest(), "bytes": len(data)}
            self.assertEqual("deck.pdf", check.deck_download(entry, site))
            for field, value in (("sha256", "0" * 64), ("bytes", 1), ("path", "../deck.pdf"), ("path", "other.pdf")):
                with self.assertRaises(ValueError):
                    check.deck_download(dict(entry, **{field: value}), site)
            with self.assertRaises(ValueError):
                check.deck_download({"format": "pdf", "url": "https://example.invalid/deck.pdf", "sha256": "0" * 64}, site)

    def test_site_media_is_hash_checked(self):
        with tempfile.TemporaryDirectory() as directory:
            site = Path(directory)
            data = b"\x00\x00\x00\x18ftypmp42 synthetic"
            (site / "clip.mp4").write_bytes(data)
            entry = {"path": "clip.mp4", "sha256": hashlib.sha256(data).hexdigest(), "bytes": len(data)}
            self.assertEqual("clip.mp4", check.media_item(entry, site))
            for field, value in (("sha256", "0" * 64), ("bytes", 1), ("path", "../clip.mp4")):
                with self.assertRaises(ValueError):
                    check.media_item(dict(entry, **{field: value}), site)
            (site / "fake.mp4").write_bytes(b"not a video")
            fake = {"path": "fake.mp4", "sha256": hashlib.sha256(b"not a video").hexdigest(), "bytes": 11}
            with self.assertRaisesRegex(ValueError, "not the type"):
                check.media_item(fake, site)

    def test_undeclared_binary_files_are_rejected(self):
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory) / "repo"
            shutil.copytree(ROOT, root, ignore=shutil.ignore_patterns(".git", "__pycache__", ".venv"))
            self.assertTrue(check.check(root)["offline_only"])
            (root / "site/extra.pdf").write_bytes(b"%PDF-1.7 not declared")
            with self.assertRaisesRegex(ValueError, "undeclared binary"):
                check.check(root)
            (root / "site/extra.pdf").unlink()
            (root / "site/extra.mp4").write_bytes(b"\x00\x00\x00\x18ftypmp42 not declared")
            with self.assertRaisesRegex(ValueError, "undeclared binary"):
                check.check(root)

    def test_retired_pack_names_are_blocked_on_public_pages(self):
        saved = check.RETIRED_NAME_HASHES
        try:
            check.RETIRED_NAME_HASHES = {hashlib.sha256(b"oldname").hexdigest()}
            self.assertTrue(check.retired_names("<p>The Oldname pack</p>"))
            self.assertFalse(check.retired_names('<li data-provenance="https://example.invalid/oldname">A pack</li>'))
            self.assertFalse(check.retired_names("<p>A collection of nouns and verbs</p>"))
        finally:
            check.RETIRED_NAME_HASHES = saved


class PortableChecks(unittest.TestCase):
    """Hunt, October 30: the check failed under an ASCII locale, and a CRLF checkout changed frozen hashes."""

    def test_the_check_reads_utf8_whatever_the_locale(self):
        env = {key: value for key, value in os.environ.items() if not key.startswith(("LC_", "LANG", "PYTHONUTF8"))}
        env.update({"LC_ALL": "C", "LANG": "C", "PYTHONCOERCECLOCALE": "0", "PYTHONUTF8": "0"})
        result = subprocess.run([sys.executable, "-X", "utf8=0", str(ROOT / "scripts/check.py")], cwd=ROOT, env=env,
                                capture_output=True, text=True, encoding="utf-8", errors="replace")
        self.assertEqual(0, result.returncode, result.stderr[-2000:])

    def test_checkouts_keep_lf_line_endings_and_binary_media(self):
        rules = (ROOT / ".gitattributes").read_text(encoding="utf-8").split("\n")
        self.assertIn("* text=auto eol=lf", rules)
        for kind in ("png", "mp4", "pdf", "pptx"):
            self.assertIn(f"*.{kind} binary", rules)


if __name__ == "__main__":
    unittest.main()