"""Check real Ansible-rendered values and Helm manifests without a cluster."""

import base64
from pathlib import Path

import yaml
from kubernetes_validate import validate
from ansible.parsing.dataloader import DataLoader
from ansible.template import Templar

# Resolve the site's actual workflow with fixture credentials only.
defaults = yaml.safe_load(Path('defaults/main.yml').read_text())
site = yaml.safe_load(Path('playbooks/deploy-eom.yml').read_text())[0]['vars']
for fixture_run in (1,):
    variables = {
        **defaults, **site,
        'dex_admin_password': 'fixture-db',
        'openldap_readonly_password': 'fixture-ldap',
        'matrix_dex_oidc_client_id': 'matrix-fixture',
        'matrix_dex_oidc_client_secret': 'fixture-matrix',
        'www_dex_client_secret': 'fixture-www',
        'gitea_dex_client_secret': 'fixture-gitea',
        'discourse_dex_client_secret': 'fixture-discourse',
        'peertube_dex_client_secret': 'fixture-peertube',
        'mastodon_dex_client_secret': 'fixture-mastodon',
        'nextcloud_dex_client_secret': 'fixture-nextcloud',
    }
    resolved = Templar(loader=DataLoader(), variables=variables).template(site)
    assert resolved['dex_issuer'] == 'https://dex.eom.dev/'
    assert resolved['dex_postgres_password'] == 'fixture-db'
    assert resolved['dex_ldap_group_user_attribute'] == 'cn'
    assert resolved['dex_theme_enabled'] is True
    assert resolved['dex_postgres_manage'] is False
    assert resolved['dex_additional_connectors'] == []
    assert resolved['dex_ldap_user_filter'] == '(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))'
    clients = {client['id']: client for client in resolved['dex_static_clients']}
    assert len(clients) == len(resolved['dex_static_clients']) == 7
    assert resolved['dex_matrix_client_enabled'] is False
    assert clients['matrix-fixture']['redirectURIs'] == ['https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4']
    assert clients['www-membership']['secret'] == 'fixture-www'
    assert clients['gitea']['redirectURIs'] == ['https://gitea.eom.dev/user/oauth2/dex/callback']
    assert clients['discourse']['redirectURIs'] == ['https://discourse.eom.dev/auth/oidc/callback']
    assert clients['peertube']['redirectURIs'] == ['https://peertube.eom.dev/plugins/auth-openid-connect/router/code-cb']
    assert clients['mastodon']['redirectURIs'] == ['https://mastodon.eom.dev/auth/auth/openid_connect/callback']
    assert clients['nextcloud']['redirectURIs'] == ['https://nextcloud.eom.dev/index.php/apps/user_oidc/code']
    assert all(client['secret'] and len(client['redirectURIs']) == 1 for client in clients.values())

values = yaml.safe_load(Path('/tmp/dex-values.yml').read_text())
config = values['config']
assert config['issuer'] == 'https://dex.example.com/'
assert config['storage']['config']['database'] == 'dex'
assert 'databbase' not in config['storage']['config']
ldap = config['connectors'][0]
assert ldap['id'] == 'ldap'
assert ldap['config']['insecureNoSSL'] is True
assert ldap['config']['startTLS'] is False
assert len(config['connectors']) == 1
assert ldap['config']['userSearch']['idAttr'] == 'uid'
assert ldap['config']['groupSearch']['userMatchers'][0]['userAttr'] == 'DN'
assert config['staticClients'][0]['id'] == 'matrix-fixture'
assert config['frontend']['logoURL'] == 'theme/logo.svg'
assert config['frontend']['dir'] == '/srv/dex/web'
assert len(values['volumeMounts']) == 3
assert all(mount['readOnly'] for mount in values['volumeMounts'] if mount['name'] != 'dex-tmp')
assert next(volume for volume in values['volumes'] if volume['name'] == 'dex-tmp')['emptyDir'] == {'medium': 'Memory', 'sizeLimit': '16Mi'}
optional = yaml.safe_load(Path('/tmp/dex-values-optional.yml').read_text())
assert 'frontend' not in optional['config']
assert optional['config']['connectors'][0]['config']['startTLS'] is True
assert optional['config']['staticClients'][0]['secretEnv'] == 'WWW_DEX_CLIENT_SECRET'
assert optional['envFrom'][0]['secretRef']['name'] == 'dex-client-secrets'
minimal = yaml.safe_load(Path('/tmp/dex-values-minimal.yml').read_text())
assert minimal['config']['staticClients'] == []
assert minimal['volumes'] == [{'name': 'dex-tmp', 'emptyDir': {'medium': 'Memory', 'sizeLimit': '16Mi'}}]
assert minimal['volumeMounts'] == [{'name': 'dex-tmp', 'mountPath': '/tmp'}]
objects = [obj for obj in yaml.safe_load_all(Path('/tmp/dex-manifests.yml').read_text()) if obj]
for obj in objects:
    validate(obj, desired_version='1.31.0', strict=True)
deployment = next(obj for obj in objects if obj['kind'] == 'Deployment')
assert deployment['metadata']['name'] == 'dex'
mounts = deployment['spec']['template']['spec']['containers'][0]['volumeMounts']
assert {'name': 'dex-tmp', 'mountPath': '/tmp'} in mounts
assert deployment['spec']['template']['spec']['containers'][0]['securityContext']['readOnlyRootFilesystem'] is True
assert any(mount['mountPath'].endswith('/light/styles.css') for mount in mounts)
secret = next(obj for obj in objects if obj['kind'] == 'Secret')
stored = yaml.safe_load(base64.b64decode(secret['data']['config.yaml']))
assert stored['storage']['config']['password'] == 'fixture-not-a-real-password'
assert not any(obj['kind'] in ['PersistentVolumeClaim', 'StatefulSet'] for obj in objects)
print(f'PASS: {len(objects)} real Helm resources; legacy identity/plain LDAP preserved, optional TLS, clients, theme mounts and Secret config validated')