import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { afterEach, expect, test } from "vitest";

import { resolveCatalogRuntimeBinding } from "../src/catalog/runtime-binding.js";
import type { WorkspaceDatabase } from "../src/catalog/types.js";
import type { WorkspaceDescriptor } from "../src/workspaces/schema.js";
import { WorkspaceSecretStore } from "../src/workspaces/secret-store.js";

const roots: string[] = [];

afterEach(() => {
  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
});

test("projects a Catalog database into a runtime without database data in workspace YAML", () => {
  const root = mkdtempSync(join(tmpdir(), "thoth-catalog-runtime-"));
  roots.push(root);
  const secretStore = new WorkspaceSecretStore({
    root: join(root, "vault"),
    runtimeRoot: join(root, "runtime"),
    installationId: "test",
  });
  secretStore.putMany("sales", {
    "catalog.dwh.password": "catalog-password",
    "evidence.signed_urls": '["https://signed.example.test/evidence"]',
  });
  const workspace: WorkspaceDescriptor = {
    workspace: {
      schema_version: 4,
      id: "sales",
      name: "Sales",
      language: "en",
    },
    evidence: {
      schema_version: 1,
      source: {
        type: "http",
        uris: ["https://evidence.example.test/guide.md"],
        authentication: "signed_urls_file",
        connect_timeout_ms: 1_000,
        read_timeout_ms: 5_000,
        max_bytes: 10_000,
        max_redirects: 2,
        allow_private_hosts: false,
        max_cache_bytes: 20_000,
      },
      policy: { max_chunk_chars: 4_000, retain_published_generations: 1 },
    },
  };
  const database: WorkspaceDatabase = {
    id: "database-1",
    workspaceId: "sales",
    engine: "postgres",
    databaseName: "warehouse",
    schema: "analytics",
    version: 3,
    createdAt: "2026-01-01T00:00:00Z",
    updatedAt: "2026-01-01T00:00:00Z",
    binding: {
      transport: "postgres_direct",
      host: "db.internal",
      port: 5432,
      username: "reader",
    },
    connectionStatus: "reachable",
    metadataContentRevision: 7,
    preprocessingStatus: "failed",
  };

  const lease = resolveCatalogRuntimeBinding({
    workspace,
    database,
    environment: {},
    secretRoots: [],
    secretStore,
  });
  const passwordPath = lease.bindings.dwh.values.THT_WS_SALES_DWH_PASSWORD_FILE;
  const evidencePath = lease.bindings.evidence.values.THT_WS_SALES_EVIDENCE_SIGNED_URLS_FILE;
  try {
    expect(workspace.dwh).toBeUndefined();
    expect(lease.workspace.dwh).toMatchObject({
      database: "warehouse",
      schema: "analytics",
      supported_transports: ["postgres_direct"],
    });
    expect(lease.bindings.dwh).toMatchObject({
      transport: "postgres_direct",
      missing: [],
      values: {
        THT_WS_SALES_DWH_HOST: "db.internal",
        THT_WS_SALES_DWH_PORT: "5432",
        THT_WS_SALES_DWH_USER: "reader",
      },
    });
    expect(readFileSync(passwordPath, "utf8")).toBe("catalog-password");
    expect(readFileSync(evidencePath, "utf8")).toContain("signed.example.test");
  } finally {
    lease.release();
  }
  expect(existsSync(passwordPath)).toBe(false);
  expect(existsSync(evidencePath)).toBe(false);
});