"""gitea — INSTALL overlay (phase gtea).

Extends the generic serving assertion with gitea-specific checks:
  - /api/healthz returns 200 (already covered by HEALTH_PATH, reinforced here)
  - /api/v1/version returns 200 JSON (API router is up)
  - Admin API is reachable and authenticated (ops.pre_install created the admin user)
  - Playwright: the sign-in page renders in a real browser
"""

from __future__ import annotations

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
from harness import browser as harness_browser  # noqa: E402
from harness import generic, lifecycle  # noqa: E402

sys.path.insert(0, os.path.dirname(__file__))
from ops import admin_creds  # noqa: E402


def test_install_gitea(live_app, meta):
    """Gitea is serving, API is up, admin API is authenticated, UI loads in browser."""
    # 1. Generic serving (services converged + HEALTH_PATH 200 + TLS valid)
    generic.assert_serving(live_app, meta)

    # 2. API version endpoint
    status, body = lifecycle.http_fetch(live_app, "/api/v1/version")
    assert status == 200, f"{live_app}/api/v1/version: HTTP {status} (expected 200)"
    assert body, "/api/v1/version: empty response body"

    # 3. Admin API reachable + authenticated — GET /api/v1/users/search as ci_admin
    user, password = admin_creds(live_app)
    import base64
    import ssl
    import urllib.request

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    auth = base64.b64encode(f"{user}:{password}".encode()).decode()
    req = urllib.request.Request(
        f"https://{live_app}/api/v1/users/search?limit=1",
        headers={"Authorization": f"Basic {auth}"},
    )
    import urllib.error

    try:
        with urllib.request.urlopen(req, timeout=15, context=ctx) as r:
            assert r.status == 200, f"Admin API /users/search returned {r.status}"
    except urllib.error.HTTPError as e:
        raise AssertionError(f"Admin API /users/search failed: HTTP {e.code}") from e

    # 4. Playwright: sign-in page renders
    from playwright.sync_api import sync_playwright

    url = f"https://{live_app}/user/login"
    with sync_playwright() as p:
        browser = p.chromium.launch(args=["--no-sandbox"])
        try:
            page = browser.new_context(ignore_https_errors=True).new_page()
            harness_browser.goto_with_retry(
                page, url, accept_statuses=(200, 302), goto_timeout_ms=30_000
            )
            page.wait_for_selector("input#user_name", timeout=20_000)
            content = page.content()
            assert (
                "gitea" in content.lower() or "sign in" in content.lower()
            ), "Sign-in page did not render expected gitea content"
        finally:
            browser.close()