"""
What the Linux packages ship of QE/default.env.

The file is unversioned and lives beside other QE notes; the packages are
public. build-node.sh once copied it whole after checking only its first 30
bytes, so any line added to it later would have gone out in every deb and rpm.
Only the validated token line may ship.

These run the build step itself (the lines from `DEFAULT_ENV=` to its echo)
under bash against a scratch repo, rather than reading its text.
"""

import shutil
import subprocess
import sys
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[3]
BUILD_NODE = ROOT / "packaging" / "build" / "build-node.sh"

pytestmark = [
    pytest.mark.skipif(not BUILD_NODE.exists(), reason="packaging not present"),
    pytest.mark.skipif(shutil.which("bash") is None, reason="no bash"),
]

TOKEN = "MESHBAY_TMDB_DEFAULT_TOKEN=eyJhbGciOi.eyJzdWIi-x_y"


def _step() -> str:
    lines = BUILD_NODE.read_text(encoding="utf-8").splitlines()
    start = next(i for i, l in enumerate(lines) if l.startswith("DEFAULT_ENV="))
    end = next(i for i in range(start, len(lines)) if "default.env:" in lines[i] and lines[i].lstrip().startswith("echo"))
    return "\n".join(lines[start : end + 1]) + "\n"


def _build(tmp_path: Path, content: bytes | None) -> Path | None:
    (tmp_path / "QE").mkdir()
    share = tmp_path / "root" / "opt" / "meshbay-node" / "share"
    share.mkdir(parents=True)
    if content is not None:
        (tmp_path / "QE" / "default.env").write_bytes(content)
    script = tmp_path / "step.sh"
    script.write_text(_step(), encoding="utf-8")
    run = subprocess.run(
        ["bash", str(script)],
        env={"REPO": str(tmp_path), "ROOT": str(tmp_path / "root"), "PATH": "/usr/bin:/bin"},
        capture_output=True,
    )
    out = share / "default.env"
    return out if run.returncode == 0 else None


def test_only_the_token_line_ships(tmp_path):
    out = _build(tmp_path, (TOKEN + "\r\nANOTHER_SECRET=hunter2\n# a note\n").encode())
    assert out is not None
    assert out.read_bytes() == (TOKEN + "\n").encode()
    # A Linux package's mode; Windows (Git's bash there) has no such bits to set.
    if sys.platform != "win32":
        assert out.stat().st_mode & 0o777 == 0o644


@pytest.mark.parametrize(
    "content",
    [
        None,
        b"",
        b"\xef\xbb\xbf" + TOKEN.encode() + b"\n",
        b"# token below\n" + TOKEN.encode() + b"\n",
        b"MESHBAY_TMDB_DEFAULT_TOKEN=eyJ\n",
        b"MESHBAY_TMDB_DEFAULT_TOKEN=eyJa b\n",
    ],
    ids=["missing", "empty", "bom", "not-first", "no-token", "space"],
)
def test_no_valid_token_line_no_build(tmp_path, content):
    assert _build(tmp_path, content) is None