"""Independent repository-state checks for benchmark correctness.

These helpers inspect durable VCS metadata on disk. They deliberately do not

parse measured command output, so a subject cannot satisfy them by printing a

successful-looking transcript.

"""

from __future__ import annotations

import hashlib

import os

import shutil

import subprocess

import tempfile

from pathlib import Path

from typing import Any, Mapping

METADATA_DIRS = (".git", ".oak")

PAYLOAD_SAMPLE_LIMIT = 3

CONTENT_FAILURE_LIMIT = 20

OAK_READER_PAYLOAD_SOURCE = "oak_independent_reader_payload_sha256"

STRONG_PUBLIC_CONTENT_INTEGRITY_SOURCES = frozenset({"git_head_payload_sha256", OAK_READER_PAYLOAD_SOURCE})

def content_integrity_source_supports_public_trust(

    source: object,

    sources: object = None,

) -> bool:

    """Return whether a content oracle source can back a public trust claim.

    Worktree-backed checks are still useful measurements, but only committed

    HEAD bytes read through known-good Git are strong enough for public content

    trust. Mixed sources inherit their weakest member.

    """

    if isinstance(sources, list):

        normalized_sources = [item for item in sources if isinstance(item, str)]

    else:

        normalized_sources = []

    if not normalized_sources and isinstance(source, str):

        normalized_sources = [source]

    return bool(normalized_sources) and all(

        item in STRONG_PUBLIC_CONTENT_INTEGRITY_SOURCES for item in normalized_sources

    )

def content_integrity_public_trust_passed(row: Mapping[str, Any]) -> bool:

    return (

        row.get("content_integrity_check_passed") is True

        and content_integrity_source_supports_public_trust(

            row.get("content_integrity_source"),

            row.get("content_integrity_sources"),

        )

    )

def parse_manifest(text: str) -> dict[str, str]:

    """Parse MANIFEST.sha256 lines in sha256sum format."""

    entries: dict[str, str] = {}

    for line in text.splitlines():

        stripped = line.strip()

        if not stripped:

            continue

        digest, separator, rel = stripped.partition("  ")

        if not separator:

            digest, separator, rel = stripped.partition(" ")

        if separator and len(digest) == 64:

            entries[rel.strip()] = digest.lower()

    return entries

def metadata_path(repo: Path) -> Path | None:

    for name in METADATA_DIRS:

        candidate = repo / name

        if candidate.exists():

            return candidate

    return None

def repository_state_fingerprint(repo: Path) -> str | None:

    root = metadata_path(repo)

    if root is None:

        return None

    digest = hashlib.sha256()

    digest.update(root.name.encode("utf-8", "surrogateescape"))

    if root.is_file():

        _hash_file(root, root.name, digest)

        return digest.hexdigest()

    for dirpath, dirnames, filenames in os.walk(root):

        dirnames[:] = sorted(name for name in dirnames if not name.endswith(".lock"))

        for filename in sorted(name for name in filenames if not name.endswith(".lock")):

            path = Path(dirpath) / filename

            rel = path.relative_to(root).as_posix()

            _hash_file(path, rel, digest)

    return digest.hexdigest()

def state_change_fields(

    repo: Path,

    before_fingerprint: str | None,

    *,

    operation: str,

    process_returncode: int,

    source: str = "direct_repo_metadata_fingerprint",

) -> dict[str, Any]:

    after_fingerprint = repository_state_fingerprint(repo)

    passed = process_returncode == 0 and before_fingerprint is not None and after_fingerprint is not None

    if passed:

        passed = before_fingerprint != after_fingerprint

    reason: str | None = None

    if process_returncode != 0:

        reason = "process_returncode_nonzero"

    elif before_fingerprint is None:

        reason = "repository_metadata_missing_before_operation"

    elif after_fingerprint is None:

        reason = "repository_metadata_missing_after_operation"

    elif before_fingerprint == after_fingerprint:

        reason = "repository_metadata_unchanged_after_successful_operation"

    return {

        "integrity_check_passed": passed,

        "integrity_failure_reason": reason,

        "integrity_check_source": source,

        "integrity_operation": operation,

        "repo_state_before": before_fingerprint,

        "repo_state_after": after_fingerprint,

    }

def content_payload_fields(

    repo: Path,

    expected_payloads: list[tuple[str, str]],

) -> dict[str, Any]:

    """Check required worktree payloads for a specific workflow phase.

    Callers decide which payloads are phase-appropriate. This helper only

    verifies the requested path/needle pairs and reports exact missing paths.

    """

    missing: list[str] = []

    for rel_path, expected in expected_payloads:

        path = repo / rel_path

        try:

            text = path.read_text(errors="replace")

        except OSError:

            missing.append(rel_path)

            continue

        if expected not in text:

            missing.append(rel_path)

    reason = None

    if missing:

        reason = "content_payload_expected_payload_missing:" + ",".join(sorted(missing))

    return {

        "content_payload_check_passed": not missing,

        "content_payload_failure_reason": reason,

        "content_payload_expected_paths": [path for path, _needle in expected_payloads],

        "content_payload_missing_paths": missing,

        "content_payload_check_source": "worktree_content_payload_attestation",

    }

def sample_worktree_payload_hashes(repo: Path, limit: int = PAYLOAD_SAMPLE_LIMIT) -> dict[str, str]:

    """Hash a small deterministic payload sample outside VCS metadata dirs."""

    paths = []

    root = Path(repo)

    for path in sorted(root.rglob("*")):

        if len(paths) >= limit:

            break

        if not path.is_file():

            continue

        rel = path.relative_to(root)

        if set(rel.parts).intersection(METADATA_DIRS):

            continue

        paths.append(rel.as_posix())

    return worktree_payload_hashes(root, paths)

def worktree_payload_hashes(repo: Path, paths: list[str]) -> dict[str, str]:

    """Return sha256 hashes for explicit repo-relative worktree payloads."""

    hashes: dict[str, str] = {}

    root = Path(repo)

    for rel in paths:

        safe_rel = _safe_relative_path(rel)

        if safe_rel is None:

            continue

        path = root / safe_rel

        if not path.is_file():

            continue

        hashes[rel] = _file_sha256(path)

    return hashes

def content_integrity_fields(

    repo: Path,

    *,

    operation: str,

    process_returncode: int,

    expected_hashes: Mapping[str, str] | None = None,

    expected_payloads: Mapping[str, str | bytes] | None = None,

) -> dict[str, Any]:

    """Verify expected payload content independently of command output.

    Git rows read committed content from HEAD with the known-good system Git.

    Oak rows read committed HEAD through the independent SQLite reader

    (no Oak code or binary). Other repositories, or an Oak reader that is

    unavailable, fall back to the worktree, which never earns public trust.

    """

    hashes = {str(path): digest.lower() for path, digest in (expected_hashes or {}).items()}

    payloads = dict(expected_payloads or {})

    paths = sorted(set(hashes) | set(payloads))

    fallback_source = "content_payload_sha256"

    sources: set[str] = set()

    failures: list[dict[str, str]] = []

    verified = 0

    if process_returncode != 0:

        return _content_fields(

            operation,

            False,

            "process_returncode_nonzero",

            fallback_source,

            len(paths),

            verified,

            failures,

            sources,

        )

    if not paths:

        return _content_fields(

            operation,

            False,

            "content_payload_expectation_missing",

            fallback_source,

            0,

            verified,

            failures,

            sources,

        )

    oak_committed = _oak_committed_payloads(Path(repo), paths)

    if isinstance(oak_committed, _ReaderUnavailable):

        # Never fall back to the worktree for an Oak repository: an

        # unreadable committed state is unmeasured (ADR-0002), not a pass.

        fields = _content_fields(operation, False, oak_committed.reason, OAK_READER_PAYLOAD_SOURCE,

                                 len(paths), 0, [], {OAK_READER_PAYLOAD_SOURCE})

        fields.update(content_integrity_check_passed=None, content_integrity_public_trust_passed=False,

                      content_integrity_unmeasured_reason=oak_committed.reason)

        return fields

    for rel in paths:

        safe_rel = _safe_relative_path(rel)

        if safe_rel is None:

            failures.append({"path": rel, "reason": "unsafe_relative_path"})

            continue

        if oak_committed is not None:

            data, read_source, error = oak_committed.get(rel, (None, OAK_READER_PAYLOAD_SOURCE, f"oak_committed_payload_missing:{rel}"))

        else:

            data, read_source, error = _read_attested_payload(Path(repo), rel)

        sources.add(read_source)

        if error is not None or data is None:

            failures.append({"path": rel, "reason": error or "payload_missing"})

            continue

        expected_hash = hashes.get(rel)

        if expected_hash is not None:

            actual_hash = hashlib.sha256(data).hexdigest()

            if actual_hash != expected_hash:

                failures.append(

                    {

                        "path": rel,

                        "reason": "sha256_mismatch",

                        "expected_sha256": expected_hash,

                        "actual_sha256": actual_hash,

                    }

                )

                continue

        expected_payload = payloads.get(rel)

        if expected_payload is not None:

            needle = expected_payload.encode("utf-8") if isinstance(expected_payload, str) else expected_payload

            if needle not in data:

                failures.append({"path": rel, "reason": "expected_payload_missing"})

                continue

        verified += 1

    passed = not failures and verified == len(paths)

    reason = None if passed else _content_failure_reason(failures)

    return _content_fields(operation, passed, reason, fallback_source, len(paths), verified, failures, sources)

def _content_fields(

    operation: str,

    passed: bool,

    reason: str | None,

    source: str,

    expected_files: int,

    verified_files: int,

    failures: list[dict[str, str]],

    sources: set[str] | None = None,

) -> dict[str, Any]:

    source_list = sorted(sources or [])

    reported_source = source_list[0] if len(source_list) == 1 else "mixed_payload_sources" if source_list else source

    public_trust_passed = passed and content_integrity_source_supports_public_trust(

        reported_source,

        source_list,

    )

    return {

        "content_integrity_check_passed": passed,

        "content_integrity_failure_reason": reason,

        "content_integrity_source": reported_source,

        "content_integrity_sources": source_list,

        "content_integrity_public_trust_passed": public_trust_passed,

        "content_integrity_operation": operation,

        "content_expected_files": expected_files,

        "content_verified_files": verified_files,

        "content_mismatches": failures[:CONTENT_FAILURE_LIMIT],

    }

def _content_failure_reason(failures: list[dict[str, str]]) -> str:

    if not failures:

        return "content_payload_check_failed"

    first = failures[0]

    path = first.get("path", "?")

    reason = first.get("reason", "content_payload_check_failed")

    return f"content_payload_{reason}:{path}"

class _ReaderUnavailable:

    def __init__(self, reason: str):

        self.reason = reason

def _oak_committed_payloads(repo: Path, paths: list[str]):

    """Committed HEAD bytes of an Oak repository via the independent reader.

    Returns None when the repository is not Oak (the caller uses its other

    sources), ``_ReaderUnavailable`` when the reader cannot measure (format

    drift, bounds): the check is then unmeasured, never a worktree pass.

    Positively invalid stored state fails every requested path.

    """

    if not (repo / ".oak" / "oak.db").is_file() or (repo / ".git").exists():

        return None

    from oakbench import oak_sqlite_reader as reader

    scope = [rel for rel in paths if _safe_relative_path(rel) is not None]

    if not scope:

        return None

    try:

        with tempfile.TemporaryDirectory(prefix="oakbench-integrity-read-") as temporary:

            destination = Path(temporary) / "tree"

            result = reader.read_committed_tree(repo, destination, reader.normalize_scope(scope))

            payloads = {}

            for rel in scope:

                target = destination / rel

                if rel in result.get("nonregular_paths", []):

                    payloads[rel] = (None, OAK_READER_PAYLOAD_SOURCE, f"oak_committed_payload_not_regular:{rel}")

                elif target.is_file() and not target.is_symlink():

                    payloads[rel] = (target.read_bytes(), OAK_READER_PAYLOAD_SOURCE, None)

            return payloads

    except reader.Invalid as exc:

        reason = f"oak_committed_state_invalid:{exc}"

        return {rel: (None, OAK_READER_PAYLOAD_SOURCE, reason) for rel in scope}

    except (reader.Unavailable, OSError, ValueError) as exc:

        return _ReaderUnavailable(f"oak_reader_unavailable:{exc}")

def _read_attested_payload(repo: Path, rel: str) -> tuple[bytes | None, str, str | None]:

    if (repo / ".git").exists():

        git = shutil.which("git")

        if git is None:

            return None, "git_head_payload_sha256", "known_good_git_unavailable_for_payload_check"

        try:

            proc = subprocess.run(

                [git, "-C", str(repo), "show", f"HEAD:{rel}"],

                stdout=subprocess.PIPE,

                stderr=subprocess.PIPE,

                check=False,

            )

        except OSError as exc:

            return None, "git_head_payload_sha256", f"known_good_git_payload_read_error:{exc}"

        if proc.returncode != 0:

            return None, "git_head_payload_sha256", f"git_head_payload_missing:{rel}"

        if _looks_like_lfs_pointer(proc.stdout):

            try:

                return (repo / rel).read_bytes(), "git_lfs_worktree_payload_sha256", None

            except OSError as exc:

                return None, "git_lfs_worktree_payload_sha256", str(exc)

        return proc.stdout, "git_head_payload_sha256", None

    path = repo / rel

    try:

        return path.read_bytes(), "worktree_payload_sha256", None

    except OSError as exc:

        return None, "worktree_payload_sha256", str(exc)

def _safe_relative_path(rel: str) -> Path | None:

    candidate = Path(rel)

    if candidate.is_absolute() or ".." in candidate.parts:

        return None

    return candidate

def _file_sha256(path: Path) -> str:

    digest = hashlib.sha256()

    with path.open("rb") as fh:

        for chunk in iter(lambda: fh.read(1024 * 1024), b""):

            digest.update(chunk)

    return digest.hexdigest()

def _looks_like_lfs_pointer(data: bytes) -> bool:

    return data.startswith(b"version https://git-lfs.github.com/spec/v1\n") and b"\noid sha256:" in data

def _hash_file(path: Path, rel: str, digest: "hashlib._Hash") -> None:

    digest.update(b"\0path:")

    digest.update(rel.encode("utf-8", "surrogateescape"))

    try:

        stat = path.lstat()

    except OSError:

        digest.update(b"\0missing")

        return

    if path.is_symlink():

        digest.update(b"\0symlink:")

        digest.update(os.readlink(path).encode("utf-8", "surrogateescape"))

        return

    if not path.is_file():

        digest.update(b"\0nonfile")

        return

    digest.update(b"\0size:")

    digest.update(str(stat.st_size).encode("ascii"))

    digest.update(b"\0content:")

    try:

        with path.open("rb") as fh:

            for chunk in iter(lambda: fh.read(1024 * 1024), b""):

                digest.update(chunk)

    except OSError as exc:

        digest.update(b"\0read_error:")

        digest.update(str(exc).encode("utf-8", "surrogateescape"))