import subprocess
from unittest.mock import MagicMock

import pytest

from id_configurator.config import Configuration
from id_configurator.context import Context
from id_configurator.modules.apt import AptModule

KEY_CONTENT = "fake-armored-gpg-key"
KEYRING_BYTES = b"fake-dearmored-keyring-bytes"

SOURCE_CONTENT = {
    "uuid": "12345678-1234-5678-1234-567812345678",
    "organisation": "InterDiode",
    "configurations": {
        "apt": {
            "sources": [
                {
                    "name": "interdiode",
                    "uris": ["http://example.invalid/debian"],
                    "suites": ["stable"],
                    "signed-by": KEY_CONTENT,
                }
            ],
        }
    },
}


def make_config() -> Configuration:
    return Configuration.model_validate(SOURCE_CONTENT)


def make_config_with(source_extra: dict, name: str = "interdiode") -> Configuration:
    data = {
        "uuid": "12345678-1234-5678-1234-567812345678",
        "organisation": "InterDiode",
        "configurations": {
            "apt": {
                "sources": [
                    {
                        "name": name,
                        "uris": ["http://example.invalid/debian"],
                        "suites": ["stable"],
                        **source_extra,
                    }
                ],
            }
        },
    }
    return Configuration.model_validate(data)


def _mock_gpg_dearmor_success(monkeypatch, output: bytes = KEYRING_BYTES) -> MagicMock:
    mock_run = MagicMock(
        return_value=subprocess.CompletedProcess(
            args=[], returncode=0, stdout=output, stderr=b""
        )
    )
    monkeypatch.setattr("id_configurator.modules.apt.subprocess.run", mock_run)
    return mock_run


def test_is_relevant_false_without_src(tmp_path) -> None:
    context = Context(config=make_config(), dst=tmp_path / "dst", src=None)
    assert AptModule().is_relevant(context) is False


def test_is_relevant_false_without_apt_dir(tmp_path) -> None:
    src = tmp_path / "src"
    src.mkdir()
    context = Context(config=make_config(), dst=tmp_path / "dst", src=src)
    assert AptModule().is_relevant(context) is False


def test_is_relevant_true_with_apt_dir(tmp_path) -> None:
    src = tmp_path / "src"
    (src / "etc/apt").mkdir(parents=True)
    context = Context(config=make_config(), dst=tmp_path / "dst", src=src)
    assert AptModule().is_relevant(context) is True


def test_apply_disables_existing_sources_and_adds_configured_ones(
    tmp_path, monkeypatch
) -> None:
    mock_run = _mock_gpg_dearmor_success(monkeypatch)
    src = tmp_path / "src"
    apt_dir = src / "etc/apt"
    sources_list_d = apt_dir / "sources.list.d"
    sources_list_d.mkdir(parents=True)

    (apt_dir / "sources.list").write_text(
        "# already disabled\ndeb http://example.invalid/legacy stable main\n\n",
        encoding="utf-8",
    )
    (sources_list_d / "extra.list").write_text(
        "deb http://example.invalid/extra stable main\n", encoding="utf-8"
    )
    (sources_list_d / "docker.sources").write_text(
        "Types: deb\nURIs: http://example.invalid/docker\nSuites: stable\nEnabled: yes\n"
        "\n"
        "Types: deb\nURIs: http://example.invalid/docker2\nSuites: stable\n"
        "\n\n",
        encoding="utf-8",
    )
    (sources_list_d / "ignored.txt").write_text("not a source file\n", encoding="utf-8")

    dst = tmp_path / "dst"
    context = Context(config=make_config(), dst=dst, src=src)

    AptModule().apply(context)

    disabled_top_level = (dst / "etc/apt/sources.list").read_text(encoding="utf-8")
    assert (
        disabled_top_level
        == "# already disabled\n# deb http://example.invalid/legacy stable main\n\n"
    )

    disabled_list = (dst / "etc/apt/sources.list.d/extra.list").read_text(
        encoding="utf-8"
    )
    assert disabled_list == "# deb http://example.invalid/extra stable main\n"

    disabled_sources = (dst / "etc/apt/sources.list.d/docker.sources").read_text(
        encoding="utf-8"
    )
    assert disabled_sources == (
        "Types: deb\nURIs: http://example.invalid/docker\nSuites: stable\nEnabled: no"
        "\n\n"
        "Types: deb\nURIs: http://example.invalid/docker2\nSuites: stable\nEnabled: no\n"
    )

    assert not (dst / "etc/apt/sources.list.d/ignored.txt").exists()

    keyring = (dst / "etc/apt/keyrings/interdiode.gpg").read_bytes()
    assert keyring == KEYRING_BYTES
    mock_run.assert_called_once()
    assert mock_run.call_args.kwargs["input"] == KEY_CONTENT.encode("utf-8")

    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
        encoding="utf-8"
    )
    assert configured_source == (
        "Types: deb\nURIs: http://example.invalid/debian\nSuites: stable\n"
        "Signed-By: /etc/apt/keyrings/interdiode.gpg\nEnabled: yes\n"
    )


def test_apply_without_existing_top_level_sources_list(tmp_path, monkeypatch) -> None:
    _mock_gpg_dearmor_success(monkeypatch)
    src = tmp_path / "src"
    (src / "etc/apt").mkdir(parents=True)
    dst = tmp_path / "dst"
    context = Context(config=make_config(), dst=dst, src=src)

    AptModule().apply(context)

    assert not (dst / "etc/apt/sources.list").exists()
    assert (dst / "etc/apt/sources.list.d/interdiode.sources").exists()


def test_apply_uses_signed_by_file_when_no_key_content(tmp_path, monkeypatch) -> None:
    mock_run = _mock_gpg_dearmor_success(monkeypatch)
    dst = tmp_path / "dst"
    context = Context(
        config=make_config_with({"signed-by-file": "/etc/apt/keyrings/existing.gpg"}),
        dst=dst,
        src=None,
    )

    AptModule().apply(context)

    mock_run.assert_not_called()
    assert not (dst / "etc/apt/keyrings").exists()
    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
        encoding="utf-8"
    )
    assert configured_source == (
        "Types: deb\nURIs: http://example.invalid/debian\nSuites: stable\n"
        "Signed-By: /etc/apt/keyrings/existing.gpg\nEnabled: yes\n"
    )


def test_apply_signed_by_takes_precedence_over_signed_by_file(
    tmp_path, monkeypatch
) -> None:
    mock_run = _mock_gpg_dearmor_success(monkeypatch)
    dst = tmp_path / "dst"
    context = Context(
        config=make_config_with(
            {
                "signed-by": KEY_CONTENT,
                "signed-by-file": "/etc/apt/keyrings/existing.gpg",
            }
        ),
        dst=dst,
        src=None,
    )

    AptModule().apply(context)

    mock_run.assert_called_once()
    assert (dst / "etc/apt/keyrings/interdiode.gpg").read_bytes() == KEYRING_BYTES
    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
        encoding="utf-8"
    )
    assert "Signed-By: /etc/apt/keyrings/interdiode.gpg\n" in configured_source


def test_apply_without_signed_by_writes_no_keyring_or_field(
    tmp_path, monkeypatch
) -> None:
    mock_run = _mock_gpg_dearmor_success(monkeypatch)
    dst = tmp_path / "dst"
    context = Context(config=make_config_with({}), dst=dst, src=None)

    AptModule().apply(context)

    mock_run.assert_not_called()
    assert not (dst / "etc/apt/keyrings").exists()
    configured_source = (dst / "etc/apt/sources.list.d/interdiode.sources").read_text(
        encoding="utf-8"
    )
    assert configured_source == (
        "Types: deb\nURIs: http://example.invalid/debian\nSuites: stable\nEnabled: yes\n"
    )


def test_apply_sanitizes_source_name_with_slash(tmp_path, monkeypatch) -> None:
    mock_run = _mock_gpg_dearmor_success(monkeypatch)
    dst = tmp_path / "dst"
    context = Context(
        config=make_config_with({"signed-by": KEY_CONTENT}, name="../../evil"),
        dst=dst,
        src=None,
    )

    AptModule().apply(context)

    keyring = dst / "etc/apt/keyrings/.._.._evil.gpg"
    assert keyring.read_bytes() == KEYRING_BYTES
    source_file = dst / "etc/apt/sources.list.d/.._.._evil.sources"
    assert "Signed-By: /etc/apt/keyrings/.._.._evil.gpg" in source_file.read_text(
        encoding="utf-8"
    )
    mock_run.assert_called_once()


def test_resolve_signed_by_raises_when_gpg_not_on_path(tmp_path, monkeypatch) -> None:
    monkeypatch.setattr("id_configurator.modules.apt.shutil.which", lambda _: None)
    dst = tmp_path / "dst"
    context = Context(config=make_config(), dst=dst, src=None)

    with pytest.raises(RuntimeError, match="gpg is not available"):
        AptModule().apply(context)


def test_resolve_signed_by_raises_on_invalid_key(tmp_path, monkeypatch) -> None:
    mock_run = MagicMock(
        return_value=subprocess.CompletedProcess(
            args=[], returncode=2, stdout=b"", stderr=b"gpg: no valid data found"
        )
    )
    monkeypatch.setattr("id_configurator.modules.apt.subprocess.run", mock_run)
    dst = tmp_path / "dst"
    context = Context(config=make_config(), dst=dst, src=None)

    with pytest.raises(RuntimeError, match="invalid GPG key for apt source interdiode"):
        AptModule().apply(context)