"""keycloak — BACKUP overlay (Phase 1d, DG4): seed a known state (the marker realm in mariadb),
back it up (assert a snapshot artifact), then mutate (delete the realm) so the RESTORE overlay
(test_restore.py) can prove the backed-up state returns. Runs on the shared deployment; the mutated
state persists for the restore tier."""

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
import kc_admin  # noqa: E402
from harness import generic  # noqa: E402


def test_backup_captures_state(live_app, meta):
    domain = live_app
    pw = kc_admin.admin_password(domain)
    tok = kc_admin.admin_token(domain, pw)

    # 1) create the marker realm, then back up (reuse the generic op: backup + assert a snapshot)
    assert kc_admin.create_marker_realm(domain, tok) in (201, 409)
    assert kc_admin.marker_realm_exists(domain, tok)
    snap = generic.do_backup(domain)
    assert snap, "backup produced no snapshot artifact"

    # backup-bot-two cycles the keycloak container during backup, so the admin API is briefly 502.
    # Wait for it to be serving again, then re-auth, before mutating via the HTTP admin API.
    generic.assert_serving(domain, meta)
    tok = kc_admin.admin_token(domain, pw)

    # 2) mutate: delete the realm (diverge from the backup)
    assert kc_admin.delete_marker_realm(domain, tok) in (204, 200)
    assert not kc_admin.marker_realm_exists(domain, tok), "delete did not take"