import json
import os
from pathlib import Path
import subprocess

import pytest

import bootstrap


def pinned(tmp_path, monkeypatch):
    data = {"repository": bootstrap.REPOSITORY, "commit": "a" * 40, "version": "0.0.0"}
    (tmp_path / "core-revision.json").write_text(json.dumps(data))
    monkeypatch.setattr(bootstrap, "ROOT", tmp_path)
    return data


def test_missing_token_stops_before_fetch(tmp_path, monkeypatch):
    pinned(tmp_path, monkeypatch)
    monkeypatch.delenv("CORE_GITHUB_TOKEN", raising=False)
    with pytest.raises(RuntimeError, match="CORE_GITHUB_TOKEN"):
        bootstrap.install_core()


def test_invalid_repository_is_rejected_before_credentials(tmp_path, monkeypatch):
    data = pinned(tmp_path, monkeypatch)
    data["repository"] = "https://example.com/private.git"
    (tmp_path / "core-revision.json").write_text(json.dumps(data))
    with pytest.raises(ValueError, match="invalid pinned"):
        bootstrap.revision()


@pytest.mark.parametrize("matches", [True, False])
@pytest.mark.parametrize("existing_checkout", [False, True])
def test_pin_and_credential_lifetime(tmp_path, monkeypatch, matches, existing_checkout):
    data = pinned(tmp_path, monkeypatch)
    monkeypatch.setenv("CORE_GITHUB_TOKEN", "test-secret")
    calls = []
    if existing_checkout:
        (tmp_path / "core").mkdir()
        (tmp_path / "core/old-source").write_text("old checkout")

    def run(args, *, env=None, **kwargs):
        calls.append((args, dict(env)))
        assert "test-secret" not in " ".join(args)
        if args[:2] == ["git", "fetch"]:
            assert args[-1] == data["commit"]
            assert env["CORE_GITHUB_TOKEN"] == "test-secret"
            assert Path(env["GIT_ASKPASS"]).exists()
        else:
            assert "CORE_GITHUB_TOKEN" not in env
        if args[:2] == ["git", "init"]:
            (Path(args[-1]) / ".git").mkdir()
        if args[:2] == ["git", "rev-parse"]:
            return data["commit"] if matches else "b" * 40
        return ""

    monkeypatch.setattr(bootstrap, "command", run)
    monkeypatch.setattr("importlib.metadata.version", lambda _: data["version"])
    if matches:
        bootstrap.install_core()
        assert (tmp_path / "core").is_dir()
        assert not (tmp_path / "core/.git").exists()
        assert not (tmp_path / "core/old-source").exists()
        assert calls[-3][0][:3] == ["uv", "pip", "install"]
        assert calls[-2][0][0] == "bash"
        assert calls[-2][0][1].endswith("/source/native/build.sh")
        assert calls[-1][0][1] == "--version"
        assert Path(calls[-1][0][0]).name == "decompile-verify-declarations"
    else:
        with pytest.raises(RuntimeError, match="differs"):
            bootstrap.install_core()
        assert not any(args[0] == "uv" for args, _ in calls)
    assert "CORE_GITHUB_TOKEN" not in os.environ
    assert not Path(calls[2][1]["GIT_ASKPASS"]).exists()


def test_git_errors_never_expose_credentials(monkeypatch):
    def fail(*args, **kwargs):
        raise subprocess.CalledProcessError(1, args[0], stderr="test-secret")

    monkeypatch.setattr(subprocess, "run", fail)
    with pytest.raises(RuntimeError) as error:
        bootstrap.command(["git", "fetch"])
    assert "test-secret" not in str(error.value)


def test_recorded_revision_matches_gitlink():
    root = Path(__file__).resolve().parents[1]
    stage = subprocess.check_output(["git", "ls-files", "--stage", "core"], cwd=root, text=True)
    mode, commit, rest = stage.split(maxsplit=2)
    assert mode == "160000"
    assert commit == bootstrap.revision()["commit"]