from __future__ import annotations

from pathlib import Path

import yaml

ROOT = Path(__file__).resolve().parents[2]


def test_server_image_installs_the_pinned_codex_cli() -> None:
    dockerfile = (ROOT / "deploy/server/Dockerfile").read_text(encoding="utf-8")
    assert "ARG CODEX_CLI_VERSION=0.150.0-alpha.8" in dockerfile
    assert '"@openai/codex@${CODEX_CLI_VERSION}"' in dockerfile
    assert "COPY --from=codex-cli /usr/local/bin/node /usr/local/bin/node" in dockerfile
    assert (
        "COPY --from=codex-cli /usr/local/lib/node_modules /usr/local/lib/node_modules"
        in dockerfile
    )
    assert (
        "COPY --from=codex-cli /usr/local/lib/node_modules/@openai/codex "
        not in dockerfile
    )
    assert (
        "RUN ln -s ../lib/node_modules/@openai/codex/bin/codex.js "
        "/usr/local/bin/codex" in dockerfile
    )
    assert "COPY --from=codex-cli /usr/local/bin/codex /usr/local/bin/codex" not in dockerfile
    assert "apt-get install --yes --no-install-recommends ca-certificates nodejs" not in dockerfile
    assert "RUN node --version" in dockerfile
    assert "&& codex --version" in dockerfile
    assert "USER 10001:10001" in dockerfile
    assert "CODEX_HOME=/var/lib/codex" in dockerfile


def test_compose_provides_a_writable_codex_home_and_fast_defaults() -> None:
    compose = yaml.safe_load((ROOT / "deploy/server/compose.yaml").read_text(encoding="utf-8"))
    web = compose["services"]["web"]
    environment = web["environment"]
    assert environment["CODEX_HOME"] == "/var/lib/codex"
    assert environment["CODEX_ASSISTANT_WORKSPACE"] == "/tmp/codex-assistant-workspace"
    assert not environment["CODEX_ASSISTANT_WORKSPACE"].startswith("/app")
    assert environment["CODEX_ASSISTANT_MODEL"] == "gpt-5.6-luna"
    assert environment["CODEX_ASSISTANT_REASONING_EFFORT"] == "low"
    assert environment["CODEX_ASSISTANT_DISABLE_WEBSOCKETS"] == "true"
    assert "codex_home:/var/lib/codex" in web["volumes"]
    for writable_mount in (
        "../../artifacts/server:/app/artifacts/server",
        "../../artifacts/tmp:/app/artifacts/tmp",
        "../../artifacts/self-repair:/app/artifacts/self-repair",
        "../../artifacts/mode-profiles:/app/artifacts/mode-profiles",
    ):
        assert writable_mount in web["volumes"]
    assert not any(
        str(mount).endswith(":/app/config/modes/vehicles/denza_n7/user")
        for mount in web["volumes"]
    )
    assert "codex_home" in compose["volumes"]
    assert web["read_only"] is True
    assert web["user"] == "10001:10001"
    assert web["security_opt"] == ["no-new-privileges:true"]
    assert web["cap_drop"] == ["ALL"]


def test_deployment_prepares_non_root_bind_mounts_and_checks_codex_readiness() -> None:
    dockerfile = (ROOT / "deploy/server/Dockerfile").read_text(encoding="utf-8")
    assert "/app/artifacts/mode-profiles" in dockerfile

    readme = (ROOT / "deploy/server/README.md").read_text(encoding="utf-8")
    setup_block = readme.split("```bash", 1)[1].split("```", 1)[0]
    writable_directories = (
        "artifacts/runs",
        "artifacts/user-presets",
        "artifacts/server",
        "artifacts/tmp",
        "artifacts/self-repair",
        "artifacts/mode-profiles",
    )
    assert "mkdir -p" in setup_block
    assert "chown -R 10001:10001" in setup_block
    assert "chmod 0700" in setup_block
    for directory in writable_directories:
        assert directory in setup_block
    assert "curl -fsS http://127.0.0.1:8511/api/health" in readme
    assert "curl -fsS http://127.0.0.1:8511/api/assistant/status" not in readme

    compose = yaml.safe_load((ROOT / "deploy/server/compose.yaml").read_text(encoding="utf-8"))
    healthcheck = compose["services"]["web"]["healthcheck"]["test"]
    rendered_healthcheck = " ".join(str(part) for part in healthcheck)
    assert "/api/health" in rendered_healthcheck
    assert "/login" not in rendered_healthcheck