import json
import subprocess
import sys
import tempfile
import unittest
from pathlib import Path


ROOT = Path(__file__).resolve().parents[2]
VALIDATOR = ROOT / "autoinstall/offline/validate-payload-lock.py"
CANDIDATE = ROOT / "autoinstall/offline/payload-lock.candidate.json"


def run(lock: Path) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [sys.executable, str(VALIDATOR), str(lock)],
        check=False,
        capture_output=True,
        text=True,
    )


def complete_lock() -> dict:
    digest = "a" * 64
    groups = {}
    for group in ("apt", "python", "runtime", "models", "source"):
        groups[group] = [{
            "id": f"test-{group}",
            "version": "1.0.0-test",
            "architecture": "amd64" if group != "source" else "all",
            "source": f"https://invalid.example/{group}/1.0.0-test",
            "target": f"payload/{group}/test.bin",
            "sha256": digest,
            "bytes": 1,
            "bytes_basis": "measured",
            "license": "TEST-ONLY"
        }]
    groups["containers"] = [{
        "id": "test-container",
        "version": "1.0.0-test",
        "architecture": "amd64",
        "source": f"invalid.example/test/image@sha256:{digest}",
        "target": "payload/containers/test.oci",
        "sha256": digest,
        "bytes": 1,
        "bytes_basis": "measured",
        "license": "TEST-ONLY"
    }]
    return {
        "schema": "nexus-one-ai.offline-workstation-payload-lock.v1",
        "product": "offline-workstation",
        "architecture": "amd64",
        "ubuntu_release": "22.04.5",
        "approval_record": "CT-G1-2026-009",
        "status": "reviewed",
        "unresolved": [],
        "objects": groups,
    }


class PayloadLockTests(unittest.TestCase):
    def test_candidate_fails_closed(self) -> None:
        result = run(CANDIDATE)
        self.assertEqual(result.returncode, 1)
        self.assertIn("status must be reviewed", result.stderr)
        self.assertIn("unresolved must be an empty array", result.stderr)

    def test_complete_test_lock_passes(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            lock = Path(directory) / "payload-lock.json"
            lock.write_text(json.dumps(complete_lock()), encoding="utf-8")
            result = run(lock)
        self.assertEqual(result.returncode, 0, result.stderr)

    def test_mutable_container_and_duplicate_target_fail(self) -> None:
        data = complete_lock()
        data["objects"]["containers"][0]["source"] = "invalid.example/test/image:latest"
        data["objects"]["python"][0]["target"] = data["objects"]["apt"][0]["target"]
        with tempfile.TemporaryDirectory() as directory:
            lock = Path(directory) / "payload-lock.json"
            lock.write_text(json.dumps(data), encoding="utf-8")
            result = run(lock)
        self.assertEqual(result.returncode, 1)
        self.assertIn("must be an OCI reference pinned with @sha256", result.stderr)
        self.assertIn("duplicate target path", result.stderr)


if __name__ == "__main__":
    unittest.main()