"""Contracts for the HCP Terraform seam (PLAT-74)."""

from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
TERRAFORM = ROOT / "terraform"
LAMBDA_TF = (TERRAFORM / "lambda.tf").read_text()
HCP_IAM = (TERRAFORM / "hcp_iam.tf").read_text()
DEPLOY = (ROOT / ".github" / "workflows" / "deploy.yaml").read_text()
CI = (ROOT / ".github" / "workflows" / "ci.yaml").read_text()
LOCALS = (TERRAFORM / "locals.tf").read_text()


def test_sam_template_removed():
    assert not (ROOT / "template.yaml").exists()
    assert not (ROOT / "samconfig.toml.example").exists()


def test_lambda_ignore_changes_includes_code_attributes():
    for attr in (
        "filename",
        "s3_bucket",
        "s3_key",
        "s3_object_version",
        "source_code_hash",
    ):
        assert attr in LAMBDA_TF
    assert "lifecycle" in LAMBDA_TF
    assert "ignore_changes" in LAMBDA_TF


def test_schedules_disabled_by_default():
    chunk = (TERRAFORM / "variables.tf").read_text().split('variable "schedules_enabled"')[1]
    chunk = chunk.split("variable ")[0]
    assert "default     = false" in chunk or "default = false" in chunk


def test_prod_only_workspace():
    versions = (TERRAFORM / "versions.tf").read_text()
    assert "afterhours-shift-manager-prod" in versions
    assert "afterhours-shift-manager-dev" not in versions
    assert 'environment = "prod"' in LOCALS
    assert "seahaven-dev" not in LOCALS


def test_in_repo_hcptf_roles():
    assert 'apply_role    = "hcptf-afterhours-shift-manager"' in LOCALS
    assert 'plan_role     = "hcptf-afterhours-shift-manager-plan"' in LOCALS
    assert "hcptf_apply" in HCP_IAM
    assert "DenyCreatePolicy" in HCP_IAM


def test_deploy_workflow_is_prod_zip_cd():
    assert "release: published" not in DEPLOY
    assert "cd-sam" not in DEPLOY
    assert "environment: prod" in DEPLOY
    assert "deploy-afterhours-prod" in DEPLOY
    assert "gh release create" not in DEPLOY
    assert "package_lambdas.py" in DEPLOY
    assert "update-function-code" in DEPLOY


def test_ci_runs_pytest_and_terraform_validate():
    assert "ci-python-sam" not in CI
    assert "pytest" in CI
    assert "terraform fmt -check" in CI
    assert "terraform init -backend=false" in CI
    assert "terraform validate" in CI


def test_seven_functions_named():
    for name in (
        "afterhours-shift-manager",
        "afterhours-weekly-post",
        "afterhours-roster-sync",
        "afterhours-roster-api",
        "afterhours-ring-scheduler",
        "afterhours-holiday-router",
        "afterhours-release-notifier",
    ):
        assert name in LOCALS


def test_weekly_post_role_is_tf_managed_name():
    assert 'role_name     = "afterhours-shift-manager-weekly-post"' in LOCALS


def test_github_deploy_trust_is_environment_prod():
    iam = (TERRAFORM / "iam_github_deploy.tf").read_text()
    assert "environment:prod" in iam or "environment:prod" in LOCALS
    assert "deploy.yaml@refs/heads/${var.github_deploy_branch}" in iam
    assert "deploy.yaml@*" not in iam
    assert "refs/tags/v*" not in iam


def test_plan_refresh_includes_provider6_s3_gets():
    assert "s3:GetLifecycleConfiguration" in HCP_IAM
    assert "s3:GetReplicationConfiguration" in HCP_IAM
    assert "s3:GetBucketReplication" in HCP_IAM