#!/usr/bin/env python3
"""Exercise Bash and PowerShell image verification with real Compose config.

No images are pulled and no containers are created. Fixture settings are fake.
"""
import argparse
import json
import os
from pathlib import Path
import subprocess
import tempfile
import time

parser = argparse.ArgumentParser()
parser.add_argument('--source', type=Path, default=Path(__file__).resolve().parent.parent)
args = parser.parse_args()
source = args.source.resolve()
started = time.monotonic()
version = '1.0.0.20261014'
image = 'registry.cn-shanghai.aliyuncs.com/comfy-ai/comfy-server'
secret = 'synthetic-config-value-must-not-be-printed'

with tempfile.TemporaryDirectory(prefix='easyai-image-config-') as temporary:
    root = Path(temporary)
    (root / '.env').write_text(f'SERVER_VERSION={version}\nFIXTURE_SECRET={secret}\n')
    binaries = root / 'bin'
    binaries.mkdir()
    sudo = binaries / 'sudo'
    sudo.write_text('#!/bin/sh\nexec "$@"\n')
    sudo.chmod(0o755)
    env = {**os.environ, 'PATH': str(binaries) + os.pathsep + os.environ['PATH'], 'UPDATE_SERVICES': 'easyai-server'}
    reports = []
    for correct in (True, False):
        selected = f'{image}:${{SERVER_VERSION}}' if correct else f'{image}:latest'
        # On the negative case a dependency deliberately has the expected image;
        # checking membership in --images output would wrongly approve it.
        dependency = 'redis:7-alpine' if correct else f'{image}:${{SERVER_VERSION}}'
        (root / 'compose.yml').write_text(f'services:\n  dependency:\n    image: {dependency}\n  easyai-server:\n    image: {selected}\n    depends_on:\n      - dependency\n    environment:\n      FIXTURE_SECRET: ${{FIXTURE_SECRET}}\n')
        config = subprocess.run(['docker','compose','config','--format','json','easyai-server'], cwd=root, env=env, text=True, capture_output=True, check=True)
        assert json.loads(config.stdout)['services']['easyai-server']['image'] == (f'{image}:{version}' if correct else f'{image}:latest')
        images = subprocess.run(['docker','compose','config','--images','easyai-server'], cwd=root, env=env, text=True, capture_output=True, check=True)
        assert len(images.stdout.splitlines()) > 1, 'Compose fixture must include dependency images'
        bash = ['bash','-c', '. "$1/scripts/init-security-env.sh"; . "$1/scripts/init-application-version-env.sh"; verify_application_version_images .env "docker compose"', 'fixture', str(source)]
        powershell = ['pwsh','-NoProfile','-NonInteractive','-Command', f". '{source}/scripts/Initialize-ApplicationVersions.ps1'; Test-ApplicationVersionImages @([pscustomobject]@{{Service='easyai-server';Image='{image}';Version='{version}'}}) @('docker','compose')"]
        for name, command in [('bash', bash), ('powershell', powershell)]:
            result = subprocess.run(command, cwd=root, env=env, text=True, errors='backslashreplace', capture_output=True, timeout=30)
            assert (result.returncode == 0) == correct, f'{name} incorrect verification: {result.stdout} {result.stderr}'
            assert secret not in result.stdout + result.stderr, 'configuration leaked'
            reports.append({'shell':name, 'correctImage':correct, 'expectedExitObserved':True})

print(json.dumps({'cases':reports,'seconds':round(time.monotonic()-started,3)}))