"""Regression guard: with default settings, every authorization v2 path stays dark.

Run before every push. A failure here means new behavior would reach production without an
explicit rollout decision.
"""

import asyncio
from pathlib import Path
from uuid import uuid4

import pytest
from alembic.config import Config
from alembic.script import ScriptDirectory
from fastapi import HTTPException
from src.config import get_settings
from src.core.migration_target import MigrationTargetError, resolve_migration_url
from src.domain.project_auth.membership_mutations_router import require_verified_app_actor
from src.domain.project_auth.membership_projection_sync import build_projection_writer
from src.domain.workspaces import service as workspace_service
from src.workers.tasks import project_membership_projection as tasks

REPO = Path(__file__).resolve().parents[1]
CLOUD_MIGRATION = REPO.parent / "P2HSCloud" / "migrations" / "0042_authz_v2_projection.sql"


def test_projection_and_sync_are_off_by_default():
    settings = get_settings()
    assert settings.project_membership_projection_enabled is False
    assert settings.cloud_auth_projection_secret == ""
    assert build_projection_writer(settings) is None


def test_workspace_hook_never_enqueues_by_default(monkeypatch):
    async def must_not_run(workspace_id):
        raise AssertionError("enqueue reached while projection is dark")

    monkeypatch.setattr("src.workers.enqueue.enqueue_reconcile_workspace_projection", must_not_run)
    asyncio.run(workspace_service._schedule_membership_projection(uuid4()))


def test_worker_entry_points_are_inert_by_default():
    skipped = {"projection_disabled", "projection_writer_unconfigured"}
    results = [
        asyncio.run(tasks.reconcile_workspace_projection({}, str(uuid4()))),
        asyncio.run(tasks.reconcile_project_membership({}, str(uuid4()))),
        asyncio.run(tasks.reconcile_all_project_memberships({})),
        asyncio.run(tasks.sync_membership_projection({}, str(uuid4()))),
        asyncio.run(tasks.sync_all_membership_projections({})),
    ]
    for result in results:
        assert result.get("skipped") in skipped, result


def test_mutation_routes_fail_closed_by_default():
    with pytest.raises(HTTPException) as exc:
        asyncio.run(require_verified_app_actor(uuid4(), None))
    assert exc.value.status_code == 503
    assert exc.value.detail["code"] == "feature_not_enabled"


def test_cloud_authorization_gate_defaults_to_off():
    if not CLOUD_MIGRATION.exists():
        pytest.skip("sibling P2HSCloud checkout not present")
    sql = CLOUD_MIGRATION.read_text(encoding="utf-8")
    assert "authz_v2_enabled INTEGER NOT NULL DEFAULT 0" in sql


def test_migrations_have_exactly_one_head():
    script = ScriptDirectory.from_config(Config(str(REPO / "alembic.ini")))
    assert len(script.get_heads()) == 1


def test_migration_target_must_be_explicit_and_not_primary():
    good = {"DATABASE_URL": "postgresql+asyncpg://u:p@h/p2hs_m190_scratch",
            "ALEMBIC_TARGET_DB": "p2hs_m190_scratch"}
    assert resolve_migration_url(good) == good["DATABASE_URL"]

    with pytest.raises(MigrationTargetError, match="explicitly"):
        resolve_migration_url({"ALEMBIC_TARGET_DB": "p2hs_m190_scratch"})
    with pytest.raises(MigrationTargetError, match="ALEMBIC_TARGET_DB must"):
        resolve_migration_url({"DATABASE_URL": good["DATABASE_URL"]})
    with pytest.raises(MigrationTargetError, match="does not match"):
        resolve_migration_url({**good, "ALEMBIC_TARGET_DB": "other"})

    primary = {"DATABASE_URL": "postgresql+asyncpg://u:p@h/p2hs_primarydb1",
               "ALEMBIC_TARGET_DB": "p2hs_primarydb1"}
    with pytest.raises(MigrationTargetError, match="primary"):
        resolve_migration_url(primary)
    allowed = {**primary, "ALEMBIC_ALLOW_PRIMARY": "1"}
    assert resolve_migration_url(allowed) == primary["DATABASE_URL"]