using FluentAssertions;
using Xunit;
using YamlDotNet.RepresentationModel;

namespace BluejayInfraLint.Tests;

[Trait("Category", "Unit")]
public sealed class Gx10AppleMdmNanohubTests
{
    private static readonly string Root = FindRepoRoot();
    private static readonly string AppRoot = Path.Combine(Root, "apps-gx10", "fc-apple-mdm");
    private static readonly IReadOnlyList<YamlMappingNode> Documents = LoadDocuments();

    [Fact]
    public void Manifest_DeclaresLockedDownNanoHubRuntime()
    {
        Documents.Should().Contain(document => Is(document, "Namespace", "fc-apple-mdm"));
        Documents.Should().Contain(document => Is(document, "ConfigMap", "fc-apple-mdm-root-ca"));
        Documents.Should().Contain(document => Is(document, "Service", "fc-apple-mdm"));
        Documents.Should().Contain(document => Is(document, "NetworkPolicy", "fc-apple-mdm-netpol"));
        Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "Secret");
        Documents.Should().NotContain(document => (document.Scalar("kind") ?? string.Empty) == "OnePasswordItem");

        var pvc = Single("PersistentVolumeClaim", "fc-apple-mdm-data");
        pvc.Scalar("spec", "storageClassName").Should().Be("local-path");
        pvc.Scalar("spec", "resources", "requests", "storage").Should().Be("2Gi");

        var deployment = Single("Deployment", "fc-apple-mdm");
        deployment.Scalar("spec", "strategy", "type").Should().Be("Recreate");
        deployment.Scalar("spec", "template", "metadata", "annotations", "fc.flowercore.io/probe-path").Should().Be("/version");
        deployment.Scalar("spec", "template", "metadata", "annotations", "flowercore.io/root-ca-sha256")
            .Should()
            .Be("a9120c88fa3ec735d790aa4cfeb61ac2946730338969015bebaccc08fe10535e");

        var maybePodSpec = deployment.Mapping("spec", "template", "spec");
        maybePodSpec.Should().NotBeNull();
        var podSpec = maybePodSpec!;
        podSpec.Scalar("enableServiceLinks").Should().Be("false");
        podSpec.Scalar("securityContext", "runAsUser").Should().Be("1654");
        podSpec.Scalar("securityContext", "runAsNonRoot").Should().Be("true");

        var container = podSpec.MappingSequence("containers").Should().ContainSingle().Subject;
        container.Scalar("name").Should().Be("nanohub");
        container.Scalar("image").Should().Be("localhost/fc-apple-mdm-nanohub:v0.2.0-20260617");
        container.Scalar("imagePullPolicy").Should().Be("Never");
        container.Scalar("securityContext", "readOnlyRootFilesystem").Should().Be("true");
        container.Scalar("securityContext", "allowPrivilegeEscalation").Should().Be("false");

        EnvValue(container, "NANOHUB_LISTEN").Should().Be(":9004");
        EnvValue(container, "NANOHUB_STORAGE").Should().Be("file");
        EnvValue(container, "NANOHUB_STORAGE_DSN").Should().Be("/var/lib/nanohub/db");
        EnvValue(container, "NANOHUB_CHECKIN").Should().Be("true");
        EnvValue(container, "NANOHUB_CA").Should().Be("/etc/nanohub/ca/root_ca.crt");
        EnvSecretName(container, "NANOHUB_API_KEY").Should().Be("fc-apple-mdm-runtime");
        EnvSecretKey(container, "NANOHUB_API_KEY").Should().Be("NANOHUB_API_KEY");
        EnvSecretName(container, "NANOHUB_WEBHOOK_URL").Should().Be("fc-apple-mdm-runtime");
        EnvSecretKey(container, "NANOHUB_WEBHOOK_URL").Should().Be("NANOHUB_WEBHOOK_URL");
        EnvSecretOptional(container, "NANOHUB_WEBHOOK_URL").Should().Be("true");

        VolumeMount(container, "data").Scalar("mountPath").Should().Be("/var/lib/nanohub");
        VolumeMount(container, "root-ca").Scalar("mountPath").Should().Be("/etc/nanohub/ca");
        VolumeMount(container, "root-ca").Scalar("readOnly").Should().Be("true");
        ProbePath(container, "startupProbe").Should().Be("/version");
        ProbePath(container, "readinessProbe").Should().Be("/version");
        container.Scalar("livenessProbe", "tcpSocket", "port").Should().Be("9004");
    }

    [Fact]
    public void Manifest_ExposesOnlyMdmCheckinAndVersionPaths()
    {
        var certificate = Single("Certificate", "fc-apple-mdm-tls");
        certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
        certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
        certificate.ScalarSequence("spec", "dnsNames").Should().ContainSingle("mdm.iamworkin.lan");

        var ingress = Single("IngressRoute", "fc-apple-mdm");
        var route = ingress.MappingSequence("spec", "routes").Should().ContainSingle().Subject;
        var match = route.Scalar("match");

        match.Should().Contain("Host(`mdm.iamworkin.lan`)");
        match.Should().Contain("PathPrefix(`/mdm`)");
        match.Should().Contain("PathPrefix(`/checkin`)");
        match.Should().Contain("PathPrefix(`/version`)");
        match.Should().NotContain("/api/v1");
        match.Should().NotContain("PathPrefix(`/api`)");
    }

    [Fact]
    public void Readme_DocumentsSecretImportAndSupportBoundary()
    {
        var readme = File.ReadAllText(Path.Combine(AppRoot, "README.md"));

        readme.Should().Contain("FlowerCore Apple MDM Runtime");
        readme.Should().Contain("Secret/fc-apple-mdm-runtime");
        readme.Should().Contain("imagePullPolicy: Never");
        readme.Should().Contain("10.0.57.202");
        readme.Should().Contain("does not create an APNs MDM push certificate");
        readme.Should().Contain("managed Wi-Fi payload");
    }

    private static YamlMappingNode Single(string kind, string name)
    {
        return Documents.Single(document => Is(document, kind, name));
    }

    private static bool Is(YamlMappingNode document, string kind, string name)
    {
        return document.Scalar("kind") == kind
            && document.Scalar("metadata", "name") == name;
    }

    private static string? EnvValue(YamlMappingNode container, string name)
    {
        return EnvMapping(container, name)?.Scalar("value");
    }

    private static string? EnvSecretName(YamlMappingNode container, string name)
    {
        return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "name");
    }

    private static string? EnvSecretKey(YamlMappingNode container, string name)
    {
        return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "key");
    }

    private static string? EnvSecretOptional(YamlMappingNode container, string name)
    {
        return EnvMapping(container, name)?.Scalar("valueFrom", "secretKeyRef", "optional");
    }

    private static string? ProbePath(YamlMappingNode container, string probeKey)
    {
        return container.Scalar(probeKey, "httpGet", "path");
    }

    private static YamlMappingNode VolumeMount(YamlMappingNode container, string name)
    {
        return container.MappingSequence("volumeMounts")
            .Single(mount => mount.Scalar("name") == name);
    }

    private static YamlMappingNode? EnvMapping(YamlMappingNode container, string name)
    {
        return container.MappingSequence("env")
            .SingleOrDefault(env => env.Scalar("name") == name);
    }

    private static IReadOnlyList<YamlMappingNode> LoadDocuments()
    {
        var stream = new YamlStream();
        using var reader = File.OpenText(Path.Combine(AppRoot, "fc-apple-mdm.yaml"));
        stream.Load(reader);

        return stream.Documents
            .Select(document => document.RootNode)
            .OfType<YamlMappingNode>()
            .Where(mapping => !string.IsNullOrWhiteSpace(mapping.Scalar("kind")))
            .ToList();
    }

    private static string FindRepoRoot()
    {
        var current = new DirectoryInfo(AppContext.BaseDirectory);
        while (current is not null)
        {
            if (Directory.Exists(Path.Combine(current.FullName, "apps-gx10"))
                && Directory.Exists(Path.Combine(current.FullName, "tests"))
                && File.Exists(Path.Combine(current.FullName, "README.md")))
            {
                return current.FullName;
            }

            current = current.Parent;
        }

        throw new DirectoryNotFoundException("Could not find bluejay-infra root.");
    }
}