const { execFile } = require("node:child_process");
const { mkdtemp, mkdir, rm, symlink, writeFile } = require("node:fs/promises");
const os = require("node:os");
const path = require("node:path");
const { promisify } = require("node:util");

const execFileAsync = promisify(execFile);
const ROOT_DIR = path.resolve(__dirname, "../../../..");
const PREFLIGHT = path.join(ROOT_DIR, "deploy/trialrun/preflight-remote.sh");

describe("deployment safety contract", () => {
  let fixtureRoot;
  let remoteDir;
  let envFile;
  let postgresDir;
  let storageDir;

  beforeEach(async () => {
    fixtureRoot = await mkdtemp(path.join(os.tmpdir(), "hyb-oa-deploy-safety-"));
    remoteDir = path.join(fixtureRoot, "app");
    envFile = path.join(remoteDir, "deploy/trialrun/.env");
    postgresDir = path.join(fixtureRoot, "postgres");
    storageDir = path.join(fixtureRoot, "storage");
    await mkdir(path.join(remoteDir, "server"), { recursive: true });
    await mkdir(path.join(remoteDir, "deploy/trialrun"), { recursive: true });
    await mkdir(postgresDir, { recursive: true });
    await mkdir(storageDir, { recursive: true });
    await writeFile(path.join(remoteDir, "server/package.json"), "{}\n");
    await writeFile(path.join(remoteDir, "deploy/trialrun/docker-compose.yml"), "services: {}\n");
    await writeFile(envFile, "APP_ORIGIN=https://example.invalid\n", { mode: 0o600 });
    await writeFile(path.join(postgresDir, "PG_VERSION"), "16\n");
  });

  afterEach(async () => {
    await rm(fixtureRoot, { recursive: true, force: true });
  });

  function preflight(overrides = {}) {
    return execFileAsync("bash", [PREFLIGHT], {
      env: {
        ...process.env,
        REMOTE_DIR: remoteDir,
        REMOTE_ENV_FILE: envFile,
        COMPOSE_FILE: "deploy/trialrun/docker-compose.yml",
        POSTGRES_DATA_DIR: postgresDir,
        STORAGE_HOST_DIR: storageDir,
        DEPLOY_DATA_MODE: "existing",
        SYNC_ENV: "0",
        ...overrides,
      },
    });
  }

  it("accepts a complete existing deployment contract", async () => {
    await expect(preflight()).resolves.toMatchObject({ stdout: expect.stringContaining("[remote-preflight][PASS]") });
  });

  it("rejects a config directory masquerading as the repository root", async () => {
    await expect(preflight({ REMOTE_DIR: path.join(remoteDir, "deploy/trialrun") })).rejects.toMatchObject({ code: 1 });
  });

  it("rejects a missing or symbolic remote env before synchronization", async () => {
    await rm(envFile);
    await expect(preflight()).rejects.toMatchObject({ code: 1 });
    await symlink(path.join(remoteDir, "missing.env"), envFile);
    await expect(preflight()).rejects.toMatchObject({ code: 1 });
  });

  it("rejects invalid existing data directories", async () => {
    await rm(path.join(postgresDir, "PG_VERSION"));
    await expect(preflight()).rejects.toMatchObject({ code: 1 });
  });

  it("runs remote preflight before rsync and reads existing contracts from systemd", async () => {
    const deploy = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/deploy.sh"), "utf8");
    const wrapper = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/deploy-existing.sh"), "utf8");
    expect(deploy.indexOf("REMOTE_PREFLIGHT_SCRIPT")).toBeGreaterThanOrEqual(0);
    expect(deploy.indexOf('>>> 3. 同步前只读校验远端部署合同')).toBeLessThan(deploy.indexOf("rsync -az --delete"));
    expect(deploy.indexOf('>>> 3. 同步前只读校验远端部署合同')).toBeLessThan(deploy.indexOf("mkdir -p '${REMOTE_DIR}'"));
    expect(wrapper).toContain("systemctl show '${DEPLOY_CONTRACT_UNIT}' -p Environment --value");
    expect(wrapper).not.toContain("docker inspect");
    expect(wrapper).not.toContain("working_dir");
    expect(wrapper).toContain("DEPLOY_DATA_MODE=existing");
    expect(wrapper).toContain("SYNC_ENV=0");
  });

  it("keeps immutable build args after stable dependency layers", async () => {
    const dockerfile = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "deploy/trialrun/Dockerfile"), "utf8");
    expect(dockerfile.indexOf("RUN apk add --no-cache bash curl")).toBeLessThan(dockerfile.indexOf("ARG VITE_BUILD_SHA"));
    expect(dockerfile.indexOf("RUN cd client && npm ci")).toBeLessThan(dockerfile.indexOf("ARG VITE_BUILD_SHA"));
    expect(dockerfile.indexOf("RUN cd server && npm ci")).toBeLessThan(dockerfile.indexOf("ARG BUILD_SHA"));
  });

  it("keeps deployment smoke output free of raw account and external identifiers", async () => {
    const seed = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/seed-trialrun.js"), "utf8");
    const external = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/smoke-external-deps.js"), "utf8");
    const runtime = await require("node:fs/promises").readFile(path.join(ROOT_DIR, "server/src/scripts/smoke-trialrun-runtime.js"), "utf8");
    expect(seed).not.toContain("${adminEmail}");
    expect(seed).not.toContain("${adminPhone}");
    expect(seed).not.toContain("${result.password}");
    expect(seed).not.toContain("generateOneTimePassword");
    expect(external).not.toContain("corpId=${config.wecomCorpId}");
    expect(external).not.toContain("redirectUri=${config.wecomRedirectUri}");
    expect(external).not.toContain("from=${config.emailFrom}");
    expect(runtime).not.toContain("${adminEmployee.employee_no}");
  });
});