"""Independent repository-state checks for benchmark correctness.

These helpers inspect durable VCS metadata on disk. They deliberately do not

parse measured command output, so a subject cannot satisfy them by printing a

successful-looking transcript.

"""

from __future__ import annotations

import hashlib

import os

import shutil

import subprocess

from pathlib import Path

from typing import Any, Mapping

METADATA_DIRS = (".git", ".oak")

PAYLOAD_SAMPLE_LIMIT = 3

CONTENT_FAILURE_LIMIT = 20

STRONG_PUBLIC_CONTENT_INTEGRITY_SOURCES = frozenset({"git_head_payload_sha256"})

def content_integrity_source_supports_public_trust(

    source: object,

    sources: object = None,

) -> bool:

    """Return whether a content oracle source can back a public trust claim.

    Worktree-backed checks are still useful measurements, but only committed

    HEAD bytes read through known-good Git are strong enough for public content

    trust. Mixed sources inherit their weakest member.

    """

    if isinstance(sources, list):

        normalized_sources = [item for item in sources if isinstance(item, str)]

    else:

        normalized_sources = []

    if not normalized_sources and isinstance(source, str):

        normalized_sources = [source]

    return bool(normalized_sources) and all(

        item in STRONG_PUBLIC_CONTENT_INTEGRITY_SOURCES for item in normalized_sources

    )

def content_integrity_public_trust_passed(row: Mapping[str, Any]) -> bool:

    return (

        row.get("content_integrity_check_passed") is True

        and content_integrity_source_supports_public_trust(

            row.get("content_integrity_source"),

            row.get("content_integrity_sources"),

        )

    )

def parse_manifest(text: str) -> dict[str, str]:

    """Parse MANIFEST.sha256 lines in sha256sum format."""

    entries: dict[str, str] = {}

    for line in text.splitlines():

        stripped = line.strip()

        if not stripped:

            continue

        digest, separator, rel = stripped.partition("  ")

        if not separator:

            digest, separator, rel = stripped.partition(" ")

        if separator and len(digest) == 64:

            entries[rel.strip()] = digest.lower()

    return entries

def metadata_path(repo: Path) -> Path | None:

    for name in METADATA_DIRS:

        candidate = repo / name

        if candidate.exists():

            return candidate

    return None

def repository_state_fingerprint(repo: Path) -> str | None:

    root = metadata_path(repo)

    if root is None:

        return None

    digest = hashlib.sha256()

    digest.update(root.name.encode("utf-8", "surrogateescape"))

    if root.is_file():

        _hash_file(root, root.name, digest)

        return digest.hexdigest()

    for dirpath, dirnames, filenames in os.walk(root):

        dirnames[:] = sorted(name for name in dirnames if not name.endswith(".lock"))

        for filename in sorted(name for name in filenames if not name.endswith(".lock")):

            path = Path(dirpath) / filename

            rel = path.relative_to(root).as_posix()

            _hash_file(path, rel, digest)

    return digest.hexdigest()

def state_change_fields(

    repo: Path,

    before_fingerprint: str | None,

    *,

    operation: str,

    process_returncode: int,

    source: str = "direct_repo_metadata_fingerprint",

) -> dict[str, Any]:

    after_fingerprint = repository_state_fingerprint(repo)

    passed = process_returncode == 0 and before_fingerprint is not None and after_fingerprint is not None

    if passed:

        passed = before_fingerprint != after_fingerprint

    reason: str | None = None

    if process_returncode != 0:

        reason = "process_returncode_nonzero"

    elif before_fingerprint is None:

        reason = "repository_metadata_missing_before_operation"

    elif after_fingerprint is None:

        reason = "repository_metadata_missing_after_operation"

    elif before_fingerprint == after_fingerprint:

        reason = "repository_metadata_unchanged_after_successful_operation"

    return {

        "integrity_check_passed": passed,

        "integrity_failure_reason": reason,

        "integrity_check_source": source,

        "integrity_operation": operation,

        "repo_state_before": before_fingerprint,

        "repo_state_after": after_fingerprint,

    }

def content_payload_fields(

    repo: Path,

    expected_payloads: list[tuple[str, str]],

) -> dict[str, Any]:

    """Check required worktree payloads for a specific workflow phase.

    Callers decide which payloads are phase-appropriate. This helper only

    verifies the requested path/needle pairs and reports exact missing paths.

    """

    missing: list[str] = []

    for rel_path, expected in expected_payloads:

        path = repo / rel_path

        try:

            text = path.read_text(errors="replace")

        except OSError:

            missing.append(rel_path)

            continue

        if expected not in text:

            missing.append(rel_path)

    reason = None

    if missing:

        reason = "content_payload_expected_payload_missing:" + ",".join(sorted(missing))

    return {

        "content_payload_check_passed": not missing,

        "content_payload_failure_reason": reason,

        "content_payload_expected_paths": [path for path, _needle in expected_payloads],

        "content_payload_missing_paths": missing,

        "content_payload_check_source": "worktree_content_payload_attestation",

    }

def sample_worktree_payload_hashes(repo: Path, limit: int = PAYLOAD_SAMPLE_LIMIT) -> dict[str, str]:

    """Hash a small deterministic payload sample outside VCS metadata dirs."""

    paths = []

    root = Path(repo)

    for path in sorted(root.rglob("*")):

        if len(paths) >= limit:

            break

        if not path.is_file():

            continue

        rel = path.relative_to(root)

        if set(rel.parts).intersection(METADATA_DIRS):

            continue

        paths.append(rel.as_posix())

    return worktree_payload_hashes(root, paths)

def worktree_payload_hashes(repo: Path, paths: list[str]) -> dict[str, str]:

    """Return sha256 hashes for explicit repo-relative worktree payloads."""

    hashes: dict[str, str] = {}

    root = Path(repo)

    for rel in paths:

        safe_rel = _safe_relative_path(rel)

        if safe_rel is None:

            continue

        path = root / safe_rel

        if not path.is_file():

            continue

        hashes[rel] = _file_sha256(path)

    return hashes

def content_integrity_fields(

    repo: Path,

    *,

    operation: str,

    process_returncode: int,

    expected_hashes: Mapping[str, str] | None = None,

    expected_payloads: Mapping[str, str | bytes] | None = None,

) -> dict[str, Any]:

    """Verify expected payload content independently of command output.

    Git rows read committed content from HEAD with the known-good system Git.

    Other repositories fall back to the worktree; paired with metadata-state

    attestation this still catches content corruption in snapshot-style rows.

    """

    hashes = {str(path): digest.lower() for path, digest in (expected_hashes or {}).items()}

    payloads = dict(expected_payloads or {})

    paths = sorted(set(hashes) | set(payloads))

    fallback_source = "content_payload_sha256"

    sources: set[str] = set()

    failures: list[dict[str, str]] = []

    verified = 0

    if process_returncode != 0:

        return _content_fields(

            operation,

            False,

            "process_returncode_nonzero",

            fallback_source,

            len(paths),

            verified,

            failures,

            sources,

        )

    if not paths:

        return _content_fields(

            operation,

            False,

            "content_payload_expectation_missing",

            fallback_source,

            0,

            verified,

            failures,

            sources,

        )

    for rel in paths:

        safe_rel = _safe_relative_path(rel)

        if safe_rel is None:

            failures.append({"path": rel, "reason": "unsafe_relative_path"})

            continue

        data, read_source, error = _read_attested_payload(Path(repo), rel)

        sources.add(read_source)

        if error is not None or data is None:

            failures.append({"path": rel, "reason": error or "payload_missing"})

            continue

        expected_hash = hashes.get(rel)

        if expected_hash is not None:

            actual_hash = hashlib.sha256(data).hexdigest()

            if actual_hash != expected_hash:

                failures.append(

                    {

                        "path": rel,

                        "reason": "sha256_mismatch",

                        "expected_sha256": expected_hash,

                        "actual_sha256": actual_hash,

                    }

                )

                continue

        expected_payload = payloads.get(rel)

        if expected_payload is not None:

            needle = expected_payload.encode("utf-8") if isinstance(expected_payload, str) else expected_payload

            if needle not in data:

                failures.append({"path": rel, "reason": "expected_payload_missing"})

                continue

        verified += 1

    passed = not failures and verified == len(paths)

    reason = None if passed else _content_failure_reason(failures)

    return _content_fields(operation, passed, reason, fallback_source, len(paths), verified, failures, sources)

def _content_fields(

    operation: str,

    passed: bool,

    reason: str | None,

    source: str,

    expected_files: int,

    verified_files: int,

    failures: list[dict[str, str]],

    sources: set[str] | None = None,

) -> dict[str, Any]:

    source_list = sorted(sources or [])

    reported_source = source_list[0] if len(source_list) == 1 else "mixed_payload_sources" if source_list else source

    public_trust_passed = passed and content_integrity_source_supports_public_trust(

        reported_source,

        source_list,

    )

    return {

        "content_integrity_check_passed": passed,

        "content_integrity_failure_reason": reason,

        "content_integrity_source": reported_source,

        "content_integrity_sources": source_list,

        "content_integrity_public_trust_passed": public_trust_passed,

        "content_integrity_operation": operation,

        "content_expected_files": expected_files,

        "content_verified_files": verified_files,

        "content_mismatches": failures[:CONTENT_FAILURE_LIMIT],

    }

def _content_failure_reason(failures: list[dict[str, str]]) -> str:

    if not failures:

        return "content_payload_check_failed"

    first = failures[0]

    path = first.get("path", "?")

    reason = first.get("reason", "content_payload_check_failed")

    return f"content_payload_{reason}:{path}"

def _read_attested_payload(repo: Path, rel: str) -> tuple[bytes | None, str, str | None]:

    if (repo / ".git").exists():

        git = shutil.which("git")

        if git is None:

            return None, "git_head_payload_sha256", "known_good_git_unavailable_for_payload_check"

        try:

            proc = subprocess.run(

                [git, "-C", str(repo), "show", f"HEAD:{rel}"],

                stdout=subprocess.PIPE,

                stderr=subprocess.PIPE,

                check=False,

            )

        except OSError as exc:

            return None, "git_head_payload_sha256", f"known_good_git_payload_read_error:{exc}"

        if proc.returncode != 0:

            return None, "git_head_payload_sha256", f"git_head_payload_missing:{rel}"

        if _looks_like_lfs_pointer(proc.stdout):

            try:

                return (repo / rel).read_bytes(), "git_lfs_worktree_payload_sha256", None

            except OSError as exc:

                return None, "git_lfs_worktree_payload_sha256", str(exc)

        return proc.stdout, "git_head_payload_sha256", None

    path = repo / rel

    try:

        return path.read_bytes(), "worktree_payload_sha256", None

    except OSError as exc:

        return None, "worktree_payload_sha256", str(exc)

def _safe_relative_path(rel: str) -> Path | None:

    candidate = Path(rel)

    if candidate.is_absolute() or ".." in candidate.parts:

        return None

    return candidate

def _file_sha256(path: Path) -> str:

    digest = hashlib.sha256()

    with path.open("rb") as fh:

        for chunk in iter(lambda: fh.read(1024 * 1024), b""):

            digest.update(chunk)

    return digest.hexdigest()

def _looks_like_lfs_pointer(data: bytes) -> bool:

    return data.startswith(b"version https://git-lfs.github.com/spec/v1\n") and b"\noid sha256:" in data

def _hash_file(path: Path, rel: str, digest: "hashlib._Hash") -> None:

    digest.update(b"\0path:")

    digest.update(rel.encode("utf-8", "surrogateescape"))

    try:

        stat = path.lstat()

    except OSError:

        digest.update(b"\0missing")

        return

    if path.is_symlink():

        digest.update(b"\0symlink:")

        digest.update(os.readlink(path).encode("utf-8", "surrogateescape"))

        return

    if not path.is_file():

        digest.update(b"\0nonfile")

        return

    digest.update(b"\0size:")

    digest.update(str(stat.st_size).encode("ascii"))

    digest.update(b"\0content:")

    try:

        with path.open("rb") as fh:

            for chunk in iter(lambda: fh.read(1024 * 1024), b""):

                digest.update(chunk)

    except OSError as exc:

        digest.update(b"\0read_error:")

        digest.update(str(exc).encode("utf-8", "surrogateescape"))