from __future__ import annotations

from pathlib import Path

from jarvis_finance.services.system_ops import ALLOWED_ACTIONS, restart_system_component, system_status


def test_system_status_reports_backend_frontend_runtime_without_secrets(tmp_path: Path) -> None:
    runtime = tmp_path / "runtime"
    repo = tmp_path / "repo"
    runtime.mkdir(); repo.mkdir()
    status = system_status(runtime_dir=runtime, repo_root=repo, api_url="http://100.85.29.67:8000")

    assert status["purpose"] == "system_ops_status_v1"
    assert status["backend"]["status"] in {"running", "offline"}
    assert status["frontend"]["status"] in {"running", "offline"}
    assert status["api_url"] == "http://100.85.29.67:8000"
    assert status["runtime_db_available"] is False
    assert "token" not in str(status).lower()
    assert "secret" not in str(status).lower()


def test_restart_uses_only_allowed_repo_scripts_and_writes_runtime_ops_log(tmp_path: Path) -> None:
    runtime = tmp_path / "runtime"
    repo = tmp_path / "repo"
    scripts = repo / "scripts"
    scripts.mkdir(parents=True)
    runtime.mkdir()
    script = scripts / "restart_frontend.sh"
    script.write_text("#!/usr/bin/env bash\necho restarted frontend\n", encoding="utf-8")
    script.chmod(0o755)

    result = restart_system_component("frontend", runtime_dir=runtime, repo_root=repo)

    assert result["status"] == "scheduled"
    assert result["action"] == "restart_frontend"
    assert result["message"]
    assert result["script"] == "scripts/restart_frontend.sh"
    assert result["worker_pid"]
    assert "restarted frontend" not in str(result).lower()  # no raw logs returned
    ops_log = runtime / "logs" / "ops_actions.jsonl"
    assert ops_log.exists()
    assert "restart_frontend" in ops_log.read_text(encoding="utf-8")


def test_restart_rejects_unknown_actions_and_never_accepts_free_commands(tmp_path: Path) -> None:
    runtime = tmp_path / "runtime"
    repo = tmp_path / "repo"
    runtime.mkdir(); repo.mkdir()

    assert set(ALLOWED_ACTIONS) == {"backend", "frontend", "dashboard"}
    try:
        restart_system_component("rm -rf /", runtime_dir=runtime, repo_root=repo)
    except ValueError as exc:
        assert "unsupported_system_action" in str(exc)
    else:
        raise AssertionError("free-form command was accepted")


def test_restart_schedules_worker_without_returning_long_logs(tmp_path: Path) -> None:
    runtime = tmp_path / "runtime"
    repo = tmp_path / "repo"
    scripts = repo / "scripts"
    scripts.mkdir(parents=True)
    runtime.mkdir()
    script = scripts / "restart_backend.sh"
    script.write_text("#!/usr/bin/env bash\necho redacted-sensitive-marker\nexit 7\n", encoding="utf-8")
    script.chmod(0o755)

    result = restart_system_component("backend", runtime_dir=runtime, repo_root=repo)

    assert result["status"] == "scheduled"
    assert result["return_code"] is None
    assert result["worker_log"].endswith("restart_backend.log")
    assert "redacted-sensitive-marker" not in str(result)