import hashlib
import json
import subprocess
import sys
import tarfile
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]
PACKAGER = ROOT / "scripts" / "build_release.py"
VERIFIER = ROOT / "scripts" / "verify_release.py"


def _fixture(root: Path) -> None:
    (root / "src").mkdir(parents=True)
    (root / "frontend").mkdir()
    (root / "src" / "main.py").write_text("print('ready')\n")
    (root / "frontend" / "index.html").write_text("<h1>Stackchain</h1>\n")
    (root / "requirements.txt").write_text("fastapi==1.0\n")
    (root / "README.md").write_text("# Stackchain\n")


def _build(source: Path, output: Path) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [
            sys.executable,
            str(PACKAGER),
            "--root",
            str(source),
            "--output-dir",
            str(output),
            "--commit",
            "a" * 40,
            "--source-date-epoch",
            "1720000000",
        ],
        text=True,
        capture_output=True,
        check=False,
    )


def test_release_bundle_is_reproducible(tmp_path):
    source = tmp_path / "source"
    _fixture(source)

    first = _build(source, tmp_path / "first")
    second = _build(source, tmp_path / "second")

    assert first.returncode == 0, first.stderr
    assert second.returncode == 0, second.stderr
    first_archive = next((tmp_path / "first").glob("*.tar.gz"))
    second_archive = next((tmp_path / "second").glob("*.tar.gz"))
    assert first_archive.read_bytes() == second_archive.read_bytes()

    manifest = json.loads(next((tmp_path / "first").glob("*.manifest.json")).read_text())
    checksum = next((tmp_path / "first").glob("*.sha256")).read_text().split()[0]
    assert manifest["commit"] == "a" * 40
    assert manifest["artifact"]["sha256"] == checksum
    assert checksum == hashlib.sha256(first_archive.read_bytes()).hexdigest()
    assert sorted(manifest["files"]) == [
        "README.md",
        "frontend/index.html",
        "requirements.txt",
        "src/main.py",
    ]
    with tarfile.open(first_archive, "r:gz") as archive:
        names = archive.getnames()
        embedded = json.load(archive.extractfile("release-manifest.json"))
    assert names == [
        "README.md",
        "frontend/index.html",
        "release-manifest.json",
        "requirements.txt",
        "src/main.py",
    ]
    assert embedded["commit"] == "a" * 40
    assert embedded["files"] == manifest["files"]


def test_release_bundle_verifier_enforces_integrity(tmp_path):
    source = tmp_path / "source"
    output = tmp_path / "dist"
    _fixture(source)
    built = _build(source, output)
    assert built.returncode == 0, built.stderr

    valid = subprocess.run(
        [sys.executable, str(VERIFIER), "--input-dir", str(output), "--commit", "a" * 40],
        text=True,
        capture_output=True,
        check=False,
    )
    assert valid.returncode == 0, valid.stderr

    archive = next(output.glob("*.tar.gz"))
    archive.write_bytes(archive.read_bytes() + b"tampered")
    tampered = subprocess.run(
        [sys.executable, str(VERIFIER), "--input-dir", str(output), "--commit", "a" * 40],
        text=True,
        capture_output=True,
        check=False,
    )
    assert tampered.returncode != 0