"""keycloak — UPGRADE overlay (Phase 1d, DG4): data-continuity, extends the generic upgrade.

The orchestrator deployed the previous published version ONCE; this overlay creates a marker realm
(DB data in mariadb) on the live app, performs the in-place upgrade via the shared op helper
(`generic.do_upgrade`, which also asserts reconverge + serving + that the deployment moved), then
asserts the realm SURVIVED (mariadb data preserved). Assertion-only on the shared deployment."""

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
import kc_admin  # noqa: E402
from harness import generic  # noqa: E402


def test_upgrade_preserves_realm(live_app, meta):
    domain = live_app
    pw = kc_admin.admin_password(domain)
    tok = kc_admin.admin_token(domain, pw)
    assert kc_admin.create_marker_realm(domain, tok) in (201, 409)
    assert kc_admin.marker_realm_exists(domain, tok), "marker realm not created"

    # in-place upgrade previous -> target (reuses the generic op: upgrade + assert reconverge/serving)
    generic.do_upgrade(domain, os.environ.get("VERSION") or None, meta)

    # re-auth (token from the old instance is fine, but get a fresh one post-upgrade) and verify
    tok2 = kc_admin.admin_token(domain, pw)
    assert kc_admin.marker_realm_exists(domain, tok2), "realm did not survive the upgrade"