#!/usr/bin/env python3
"""ADVERSARY check6 — WC1.2 pre-deploy SAFETY gate (live, cold). A hold must do NO deploy.
  (a) MAJOR fake tag 11.0.0+27.0.0 -> held-major, alert, kc untouched (TYPE same, 200)
  (b) minor tag 10.7.2+26.6.3 + releaseNotes flagging manual migration -> held-manual-migration,
      alert CARRIES the notes, kc untouched
Leaves the recipe + kc exactly as found (canonical, no fake tags/notes)."""
import json, os, subprocess, sys
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
import warm_reconcile as wr

D = "warm-keycloak.ci.commoninternet.net"
RDIR = os.path.expanduser("~/.abra/recipes/keycloak")
GOOD = "04400df"; CANON = "10.7.1+26.6.2"
T_MAJOR = "11.0.0+27.0.0"; T_MINOR = "10.7.2+26.6.3"
NOTES = os.path.join(RDIR, "releaseNotes", T_MINOR + ".md")
ALERTS = os.path.join(wr.warmsnap.DEFAULT_WARM_ROOT, "alerts")
fails = []

def git(*a, check=True):
    return subprocess.run(["git", "-C", RDIR, "-c", "user.email=adv@cc-ci", "-c", "user.name=adv", *a],
                          capture_output=True, text=True, check=check)
def reconcile():
    env = {**os.environ, "CCCI_SKIP_FETCH": "1"}
    r = subprocess.run(["python3", os.path.join(os.path.dirname(__file__), "warm_reconcile.py"), "keycloak"],
                       capture_output=True, text=True, env=env, timeout=300)
    for line in r.stdout.splitlines():
        if line.startswith("RECONCILE RESULT:"): return line.split(":", 1)[1].strip()
    return f"<no result rc={r.returncode}> {r.stdout[-300:]} {r.stderr[-300:]}"
def alerts_now(): return set(os.listdir(ALERTS)) if os.path.isdir(ALERTS) else set()

type0, lg0 = wr.current_version(D), wr.read_last_good("keycloak")
print(f"START TYPE={type0} last_good={lg0} health={wr.health_code(wr.SPECS['keycloak'])}")
assert type0 == CANON, f"precond: kc not canonical ({type0})"

# (a) MAJOR -> held-major, no deploy
git("reset", "--hard", GOOD)
git("tag", "-a", "-m", "adv", T_MAJOR, GOOD + "^{commit}", check=False)
a0 = alerts_now()
res_a = reconcile()
new_a = sorted(alerts_now() - a0)
print(f"(a) MAJOR {T_MAJOR}: result={res_a!r} TYPE={wr.current_version(D)} new_alerts={new_a}")
if not res_a.startswith("held-major"): fails.append(f"(a) not held-major: {res_a}")
if wr.current_version(D) != CANON: fails.append(f"(a) kc TYPE changed to {wr.current_version(D)}")
hm = [x for x in new_a if "held-major" in x]
if not hm: fails.append("(a) no held-major alert")
else:
    rec = json.load(open(os.path.join(ALERTS, hm[0])))
    if rec.get("latest") != T_MAJOR: fails.append(f"(a) alert latest={rec.get('latest')}")
    if "release_notes" not in rec: fails.append("(a) alert missing release_notes field")
git("tag", "-d", T_MAJOR, check=False)

# (b) minor + manual-migration notes -> held-manual-migration, no deploy, alert carries notes
git("tag", "-a", "-m", "adv", T_MINOR, GOOD + "^{commit}", check=False)
os.makedirs(os.path.dirname(NOTES), exist_ok=True)
open(NOTES, "w").write("# 10.7.2\n\nThis release requires a **manual migration**: run the DB upgrade by hand.\n")
b0 = alerts_now()
res_b = reconcile()
new_b = sorted(alerts_now() - b0)
print(f"(b) MINOR+migration {T_MINOR}: result={res_b!r} TYPE={wr.current_version(D)} new_alerts={new_b}")
if not res_b.startswith("held-manual-migration"): fails.append(f"(b) not held-manual-migration: {res_b}")
if wr.current_version(D) != CANON: fails.append(f"(b) kc TYPE changed to {wr.current_version(D)}")
hmm = [x for x in new_b if "manual-migration" in x]
if not hmm: fails.append("(b) no held-manual-migration alert")
else:
    rec = json.load(open(os.path.join(ALERTS, hmm[0])))
    if "manual migration" not in (rec.get("release_notes") or "").lower():
        fails.append(f"(b) alert release_notes lacks the notes: {rec.get('release_notes')!r}")

# cleanup
git("tag", "-d", T_MINOR, check=False)
if os.path.exists(NOTES): os.remove(NOTES)
git("reset", "--hard", GOOD)
faketags = [t for t in git("tag").stdout.split() if t in (T_MAJOR, T_MINOR)]
print(f"END TYPE={wr.current_version(D)} last_good={wr.read_last_good('keycloak')} "
      f"health={wr.health_code(wr.SPECS['keycloak'])} faketags={faketags} notes_exists={os.path.exists(NOTES)}")
if wr.current_version(D) != CANON: fails.append(f"END not canonical: {wr.current_version(D)}")
if faketags: fails.append(f"leftover fake tags {faketags}")
if wr.read_last_good("keycloak") != CANON: fails.append(f"last_good moved to {wr.read_last_good('keycloak')}")

print("\nRESULT:", "FAIL: " + "; ".join(fails) if fails else "PASS — WC1.2 holds major + manual-migration with notes-carrying alert; kc untouched (no deploy/last_good churn)")
sys.exit(1 if fails else 0)