"""
Tests focusing on Terraform variable validation logic introduced/modified in the PR diff.

Testing library/framework: pytest (Python). No external dependencies are required.
Strategy: statically parse HCL (.tf) files to verify validation expressions, defaults,
types, and error messages for specific variables without invoking the Terraform CLI.

Covered variables (from diff):
- auto_scaler_profile_expander
- automatic_channel_upgrade
- green_field_application_gateway_for_ingress
- http_proxy_config
- identity_type
- kms_key_vault_network_access
- load_balancer_sku
- log_analytics_solution
- sku_tier
- support_plan
"""

from __future__ import annotations

from pathlib import Path
import re
import os
import pytest


# ---------- Helpers: HCL variable block discovery and simple parsing ----------

REPO_ROOT = Path(__file__).resolve().parents[1]


def _iter_tf_files():
    for p in REPO_ROOT.rglob("*.tf"):
        # Skip Terraform working dirs and cache
        if any(part.startswith(".terraform") for part in p.parts):
            continue
        yield p


def _find_variable_block(var_name: str) -> tuple[Path, str]:
    """
    Locate and return (path, block_text) for: variable "<var_name>" { ... }.
    Raises AssertionError if not found or braces are unbalanced.
    """
    pat = re.compile(rf'variable\s+"{re.escape(var_name)}"\s*\{{', re.IGNORECASE)
    for tf in _iter_tf_files():
        text = tf.read_text(encoding="utf-8")
        m = pat.search(text)
        if not m:
            continue
        # start at the opening brace of the variable block
        start = m.end() - 1
        block = _extract_brace_block(text, start_index=start)
        return tf, block
    raise AssertionError(f'variable "{var_name}" not found')


def _extract_brace_block(s: str, start_index: int) -> str:
    """Return substring from the opening brace at start_index through its matching closing brace."""
    assert s[start_index] == "{", "Expected opening brace at start_index"
    depth = 0
    i = start_index
    while i < len(s):
        c = s[i]
        if c == "{":
            depth += 1
        elif c == "}":
            depth -= 1
            if depth == 0:
                return s[start_index : i + 1]
        i += 1
    raise AssertionError("Unbalanced braces.")


def _extract_first_block(block_text: str, header_keyword: str) -> str:
    """
    Extract the first nested block for a given keyword (e.g., 'validation', 'type = object {').

    For 'validation', we match `validation { ... }`.

    For object types, match `type = object { ... }`.

    Returns the inner-brace-inclusive string starting at '{' and ending at the matching '}'.
    """
    if header_keyword == "validation":
        m = re.search(r"\bvalidation\s*\{", block_text)
    elif header_keyword == "object_type":
        m = re.search(r"\btype\s*=\s*object\s*\{", block_text)
    else:
        raise ValueError("Unsupported header keyword")

    if not m:
        return ""
    start = m.end() - 1
    return _extract_brace_block(block_text, start_index=start)


def _default_value_of(block_text: str):
    """
    Return:
      - None if default = null (explicit) or no default found
      - string for quoted defaults
      - raw token for unquoted simple defaults
    """
    m_null = re.search(r"^\s*default\s*=\s*null\s*$", block_text, re.MULTILINE | re.IGNORECASE)
    if m_null:
        return None
    m_str = re.search(r'^\s*default\s*=\s*"([^"]*)"\s*$', block_text, re.MULTILINE)
    if m_str:
        return m_str.group(1)
    m_tok = re.search(r"^\s*default\s*=\s*([^\s#]+)\s*$", block_text, re.MULTILINE)
    if m_tok:
        return m_tok.group(1)
    return None


def _error_message_text(block_text: str) -> str:
    m = re.search(r'error_message\s*=\s*"([^"]*)"', block_text)
    return m.group(1) if m else ""


def _contains_list_from_validation(validation_block: str) -> set[str] | None:
    """
    Parse contains([ "a","b",... ], var.xxx) and return the set of allowed values.
    If not present, return None.
    """
    m = re.search(r"contains\s*\(\s*\[(.*?)\]\s*,", validation_block, re.DOTALL)
    if not m:
        return None
    raw = m.group(1)
    items = [x.strip() for x in raw.split(",") if x.strip()]
    out: list[str] = []
    for it in items:
        q = re.match(r'"([^"]*)"', it)
        if q:
            out.append(q.group(1))
    return set(out)


def _equality_values_from_validation(validation_block: str) -> set[str]:
    """
    Collect RHS string literals from occurrences like: var.x == "Value".
    """
    return set(re.findall(r'==\s*"([^"]+)"', validation_block))


def _object_field_names(object_type_block: str) -> set[str]:
    """
    Return field names declared within an object({ ... }) type block.
    Matches both optional(...) and direct type assignments e.g., id = string.
    """
    if not object_type_block:
        return set()
    return set(re.findall(r"^\s*([A-Za-z_]\w*)\s*=", object_type_block, re.MULTILINE))


# Small assertion helper to ensure error messages mention all expected tokens
def _assert_message_mentions_all(msg: str, tokens: set[str]):
    for t in tokens:
        assert t in msg, f"Expected token '{t}' in error message, got: {msg\!r}"


# ---------- Tests for specific variables from the diff ----------


def test_auto_scaler_profile_expander_validation_and_default():
    _, block = _find_variable_block("auto_scaler_profile_expander")
    validation = _extract_first_block(block, "validation")
    allowed = _contains_list_from_validation(validation)
    assert allowed == {"least-waste", "most-pods", "priority", "random"}
    assert _default_value_of(block) == "random"
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"least-waste", "most-pods", "priority", "random"})


def test_automatic_channel_upgrade_allows_null_or_known_values():
    _, block = _find_variable_block("automatic_channel_upgrade")
    # default should be null (disabled by default)
    assert _default_value_of(block) is None
    validation = _extract_first_block(block, "validation")
    # Ensure the null short-circuit exists
    assert re.search(r"==\s*null\s*\?\s*true\s*:", validation), "Expected ternary null short-circuit in validation."
    allowed = _contains_list_from_validation(validation)
    assert allowed == {"patch", "stable", "rapid", "node-image"}
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"patch", "stable", "rapid", "node-image"})


def test_green_field_application_gateway_for_ingress_requires_subnet_one_of():
    _, block = _find_variable_block("green_field_application_gateway_for_ingress")
    # default null is allowed
    assert _default_value_of(block) is None
    obj = _extract_first_block(block, "object_type")
    fields = _object_field_names(obj)
    assert {"name", "subnet_cidr", "subnet_id"}.issubset(fields)
    validation = _extract_first_block(block, "validation")
    # Ensure validation references both subnet_id and subnet_cidr via coalesce
    assert "subnet_id" in validation and "subnet_cidr" in validation
    assert "coalesce(" in validation and "can(" in validation
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"subnet_cidr", "subnet_id"})


def test_http_proxy_config_requires_at_least_one_proxy():
    _, block = _find_variable_block("http_proxy_config")
    assert _default_value_of(block) is None
    obj = _extract_first_block(block, "object_type")
    fields = _object_field_names(obj)
    assert {"http_proxy", "https_proxy", "no_proxy", "trusted_ca"}.issubset(fields)
    # Ensure no_proxy type remains list(string)
    assert re.search(r"no_proxy\s*=\s*optional\s*\(\s*list\s*\(\s*string\s*\)\s*\)", obj), "Expected no_proxy to be optional(list(string))"
    validation = _extract_first_block(block, "validation")
    assert "http_proxy_config.http_proxy" in validation
    assert "http_proxy_config.https_proxy" in validation
    assert "coalesce(" in validation and "can(" in validation
    msg = _error_message_text(block)
    assert "cannot be both empty" in msg


def test_identity_type_allowed_values_and_default():
    _, block = _find_variable_block("identity_type")
    assert _default_value_of(block) == "SystemAssigned"
    validation = _extract_first_block(block, "validation")
    eq_vals = _equality_values_from_validation(validation)
    assert {"SystemAssigned", "UserAssigned"}.issubset(eq_vals)
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"SystemAssigned", "UserAssigned"})


def test_kms_key_vault_network_access_allowed_values_and_default():
    _, block = _find_variable_block("kms_key_vault_network_access")
    assert _default_value_of(block) == "Public"
    validation = _extract_first_block(block, "validation")
    allowed = _contains_list_from_validation(validation)
    assert allowed == {"Private", "Public"}
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"Private", "Public"})


def test_load_balancer_sku_allowed_values_and_default():
    _, block = _find_variable_block("load_balancer_sku")
    assert _default_value_of(block) == "standard"
    validation = _extract_first_block(block, "validation")
    allowed = _contains_list_from_validation(validation)
    assert allowed == {"basic", "standard"}
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"basic", "standard"})


def test_log_analytics_solution_null_or_non_empty_id():
    _, block = _find_variable_block("log_analytics_solution")
    assert _default_value_of(block) is None
    obj = _extract_first_block(block, "object_type")
    fields = _object_field_names(obj)
    assert "id" in fields
    # Ensure id is declared as string
    assert re.search(r"^\s*id\s*=\s*string\s*$", obj, re.MULTILINE), "Expected id = string in object type."
    validation = _extract_first_block(block, "validation")
    # Must accept null or object with non-empty id
    assert re.search(r"==\s*null\s*\?\s*true\s*:", validation), "Expected ternary null short-circuit in validation."
    assert re.search(r"\.id\s*\\!=\s*null", validation) and re.search(r'\.id\s*\\!=\s*""', validation)
    msg = _error_message_text(block)
    assert "must be `null` or an object with a valid `id`" in msg.replace("\u2019", "'").replace("`", "`")


def test_sku_tier_allowed_values_and_default_and_message_mentions_paid():
    _, block = _find_variable_block("sku_tier")
    assert _default_value_of(block) == "Free"
    validation = _extract_first_block(block, "validation")
    allowed = _contains_list_from_validation(validation)
    assert allowed == {"Free", "Standard", "Premium"}
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"Free", "Standard", "Premium"})
    # Messaging explicitly mentions that 'Paid' is no longer supported
    assert "Paid" in msg


def test_support_plan_allowed_values_and_default():
    _, block = _find_variable_block("support_plan")
    assert _default_value_of(block) == "KubernetesOfficial"
    validation = _extract_first_block(block, "validation")
    allowed = _contains_list_from_validation(validation)
    assert allowed == {"KubernetesOfficial", "AKSLongTermSupport"}
    msg = _error_message_text(block)
    _assert_message_mentions_all(msg, {"KubernetesOfficial", "AKSLongTermSupport"})