from __future__ import annotations

import json
import subprocess
from pathlib import Path

REPO_ROOT = Path(__file__).resolve().parents[1]


def test_redact_restore_canary_capsule_removes_private_paths(tmp_path: Path) -> None:
    proof = tmp_path / "sqlite-postgres-restore-canary.json"
    output = tmp_path / "restore-capsule.json"
    proof.write_text(
        json.dumps(
            {
                "artifact": "sqlite_postgres_restore_canary",
                "generated_at_utc": "2026-07-07T12:00:00+00:00",
                "status": "pass",
                "source_sqlite_backup": "/private/path/teleo.db.gz",
                "source_sqlite_backup_sha256": "abc123",
                "source_integrity_check": "ok",
                "postgres_image": "postgres:16-alpine",
                "postgres_schema": "teleo_restore",
                "source_table_count": 2,
                "target_table_count": 2,
                "source_total_rows": 4,
                "target_total_rows": 4,
                "mismatched_tables": [],
                "conversion_notes": {"mode": "shadow_restore"},
                "conversion_stats": {"blob_values_hex_encoded": 0},
                "private_artifacts": {
                    "source_summary_json": "/private/path/source-summary.json",
                    "postgres_import_sql": "/private/path/import.sql",
                    "target_counts_csv": "/private/path/counts.csv",
                },
            }
        )
    )

    completed = subprocess.run(
        [
            "python3",
            "ops/redact_sqlite_postgres_restore_canary.py",
            "--proof",
            str(proof),
            "--output",
            str(output),
        ],
        cwd=REPO_ROOT,
        text=True,
        capture_output=True,
        check=False,
    )

    assert completed.returncode == 0, completed.stderr
    capsule = json.loads(output.read_text())
    rendered = output.read_text()
    assert capsule["artifact"] == "sqlite_postgres_restore_canary_capsule"
    assert capsule["status"] == "pass"
    assert capsule["source_table_count"] == 2
    assert capsule["target_total_rows"] == 4
    assert capsule["mismatched_table_count"] == 0
    assert capsule["source_sqlite_backup_sha256"] == "abc123"
    assert "source_sqlite_backup" not in capsule
    assert "private_artifacts" not in capsule
    assert "/private/path" not in rendered


def test_redact_restore_canary_capsule_fails_for_mismatched_rows(tmp_path: Path) -> None:
    proof = tmp_path / "sqlite-postgres-restore-canary.json"
    output = tmp_path / "restore-capsule.json"
    proof.write_text(
        json.dumps(
            {
                "artifact": "sqlite_postgres_restore_canary",
                "generated_at_utc": "2026-07-07T12:00:00+00:00",
                "status": "pass",
                "source_integrity_check": "ok",
                "source_table_count": 1,
                "target_table_count": 1,
                "source_total_rows": 4,
                "target_total_rows": 3,
                "mismatched_tables": [{"table": "claims", "source_rows": 4, "target_rows": 3}],
            }
        )
    )

    completed = subprocess.run(
        [
            "python3",
            "ops/redact_sqlite_postgres_restore_canary.py",
            "--proof",
            str(proof),
            "--output",
            str(output),
        ],
        cwd=REPO_ROOT,
        text=True,
        capture_output=True,
        check=False,
    )

    assert completed.returncode == 1
    capsule = json.loads(output.read_text())
    assert capsule["status"] == "fail"
    assert "total_rows source=4 target=3" in capsule["problems"]