#!/usr/bin/env python3
"""Read-only, credential-free evidence for a partial fixture provision attempt."""

from __future__ import annotations

import json
from pathlib import Path
import sys


SCRIPT_DIR = Path(__file__).resolve().parent
if str(SCRIPT_DIR) not in sys.path:
    sys.path.insert(0, str(SCRIPT_DIR))

import phase1_e2e_entry_gate as gate  # noqa: E402
import phase1_e2e_harness as harness  # noqa: E402
from phase1_e2e_provision import (  # noqa: E402
    ACTIVITY_NAMES,
    PAIR_NAMES,
    ProvisionConfig,
    ProvisionError,
)


def execute() -> dict:
    config = ProvisionConfig.from_environment()
    gate.bootstrap_django_runtime()

    from django.conf import settings
    from django.db.models import Q

    from api.models import IntegrationOutbox, TtActivity, TtLocation, TtStaff, User
    from api.services.integration.readiness import phase1_readiness

    readiness = phase1_readiness(require_enabled=True)
    if not readiness["ready"] or readiness["reverse_delivery_enabled"]:
        raise ProvisionError("Timetabler source readiness guard failed")

    token = settings.RESOURCE_BOOKING_INTEGRATION.get("SNAPSHOT_SERVICE_TOKEN")
    if not token:
        raise ProvisionError("snapshot service token is unavailable")
    base_url = gate.validate_base_url(config.timetabler_base_url, "Timetabler base URL")
    public_health = gate._request_json(
        "GET",
        f"{base_url}/api/integration/resource-booking/v1/health",
        headers={"Authorization": f"Bearer {token}"},
    )
    public_watermark = gate.validate_timetabler_health(
        public_health, config.source_scope
    )
    local_watermark = harness._current_watermark()

    actor = User.objects.filter(email=config.timetabler_email).first()
    actor_id = actor.id if actor is not None else None
    prefix = config.run_id
    expected_codes = {
        "staff": [f"{prefix}-fixture-staff-{name}" for name in PAIR_NAMES],
        "location": [f"{prefix}-fixture-location-{name}" for name in PAIR_NAMES],
        "activity": [f"{prefix}-{name}" for name in ACTIVITY_NAMES],
    }
    models = {"staff": TtStaff, "location": TtLocation, "activity": TtActivity}
    fixtures = {}
    for kind, model in models.items():
        rows = list(
            model.objects.filter(code__in=expected_codes[kind])
            .order_by("id")
            .values("id", "code", "status", "created_by")
        )
        fixtures[kind] = [
            {
                "id": int(row["id"]),
                "code": row["code"],
                "active": row["status"] == 1,
                "owned_by_e2e_identity": actor_id is not None
                and row["created_by"] == actor_id,
            }
            for row in rows
        ]

    request_prefix = f"{prefix}-provision-"
    outbox_rows = list(
        IntegrationOutbox.objects.filter(
            Q(request_id__startswith=request_prefix)
            | Q(correlation_id__startswith=request_prefix)
        )
        .order_by("transport_sequence", "transaction_index")
        .values(
            "aggregate_type",
            "aggregate_id",
            "request_id",
            "correlation_id",
            "transport_sequence",
            "transaction_index",
            "transaction_count",
            "transaction_finalized",
            "status",
            "change_set_id",
        )[:64]
    )
    source_evidence = [
        {
            **row,
            "change_set_id": str(row["change_set_id"]),
        }
        for row in outbox_rows
    ]

    first_code = expected_codes["staff"][0]
    first_fixture = next(
        (row for row in fixtures["staff"] if row["code"] == first_code), None
    )
    first_request = f"{request_prefix}staff-bulk"
    first_events = [
        row
        for row in source_evidence
        if row["request_id"] == first_request
        or row["correlation_id"] == first_request
    ]
    if local_watermark != public_watermark:
        classification = "api_origin_source_watermark_mismatch"
    elif first_fixture and first_events:
        classification = "first_mutation_committed_with_source_transaction"
    elif first_fixture:
        classification = "first_mutation_committed_without_source_transaction"
    elif first_events:
        classification = "source_transaction_without_first_fixture"
    else:
        classification = "first_mutation_not_committed"

    return {
        "fixture_provision_inspection": "passed",
        "run_id": prefix,
        "git_sha": config.expected_sha,
        "local_source_watermark": local_watermark,
        "public_source_watermark": public_watermark,
        "publisher_last_sequence": readiness["publisher_last_sequence"],
        "reverse_delivery_enabled": False,
        "fixture_counts": {
            kind: len(rows) for kind, rows in fixtures.items()
        },
        "fixtures": fixtures,
        "source_event_count": len(source_evidence),
        "source_evidence": source_evidence,
        "first_expected_mutation": "staff-bulk",
        "classification": classification,
        "mutation_executed_by_inspection": False,
        "load_executed": False,
        "dr_executed": False,
    }


def main() -> int:
    try:
        print(json.dumps(execute(), sort_keys=True, default=str))
        return 0
    except (ProvisionError, gate.EntryGateError) as error:
        print(
            json.dumps(
                {"fixture_provision_inspection": "blocked", "reason": str(error)},
                sort_keys=True,
            ),
            file=sys.stderr,
        )
        return 3


if __name__ == "__main__":
    raise SystemExit(main())