# coding=utf-8
from pathlib import Path
from unittest.mock import patch

import httpx
import pytest

from spark_executor.core import connection_store
from spark_executor.core.connection_store import ConnectionStore
from spark_executor.models import Connection
from spark_executor.tools import connections, fetch_url


def _fresh_stores(tmp_path, monkeypatch):
    """Reset connection store singletons for a single test."""
    monkeypatch.setattr(connection_store, "DEFAULT_DATA_DIR", str(tmp_path))
    store = ConnectionStore()
    monkeypatch.setattr(connection_store, "store", store)
    connections.store = store
    fetch_url.conn_store = store


@pytest.fixture
def fresh_stores(tmp_path: Path, monkeypatch):
    """Reset connection store singletons for a single test."""
    _fresh_stores(tmp_path, monkeypatch)
    yield

def test_fetch_url_returns_body_and_status(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            allowed_url_hosts=["*.prod.internal"],
        )
    )
    resp = httpx.Response(200, text="hello", headers={"content-type": "text/html"})
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        out = fetch_url.fetch_url("http://nm01.prod.internal:8042/node", "prod")
    assert out.url == "http://nm01.prod.internal:8042/node"
    assert out.status_code == 200
    assert out.content_type == "text/html"
    assert out.body == "hello"
    assert out.truncated is False
    assert m.call_count == 1


def test_fetch_url_raises_for_missing_connection(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    with pytest.raises(KeyError, match="Connection not found"):
        fetch_url.fetch_url("http://rm.prod.internal:8088/", "missing")


def test_fetch_url_rejects_non_http_scheme(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(name="prod", master="yarn", yarn_rm_url="http://rm.prod.internal:8088")
    )
    with pytest.raises(ValueError, match="scheme"):
        fetch_url.fetch_url("file:///etc/passwd", "prod")


def test_fetch_url_rejects_ftp_scheme(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(name="prod", master="yarn", yarn_rm_url="http://rm.prod.internal:8088")
    )
    with pytest.raises(ValueError, match="scheme"):
        fetch_url.fetch_url("ftp://rm.prod.internal/foo", "prod")


def test_fetch_url_rejects_ip_literal(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(name="prod", master="yarn", yarn_rm_url="http://rm.prod.internal:8088")
    )
    with pytest.raises(ValueError, match="IP literal"):
        fetch_url.fetch_url("http://10.0.0.1/secrets", "prod")


def test_fetch_url_rejects_ipv6_literal(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(name="prod", master="yarn", yarn_rm_url="http://rm.prod.internal:8088")
    )
    with pytest.raises(ValueError, match="IP literal"):
        fetch_url.fetch_url("http://[::1]:8080/", "prod")


def test_fetch_url_rejects_external_host(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            allowed_url_hosts=["*.prod.internal"],
        )
    )
    with pytest.raises(ValueError, match="is not in Connection.allowed_url_hosts"):
        fetch_url.fetch_url("http://evil.com/foo", "prod")


def test_fetch_url_rejects_unrelated_single_label_host(tmp_path, monkeypatch):
    """Without a common suffix rule, a single-label RM host no longer helps."""
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(name="prod", master="yarn", yarn_rm_url="http://rm:8088")
    )
    with pytest.raises(ValueError, match="allowed_url_hosts is empty"):
        fetch_url.fetch_url("http://other-rm/", "prod")


def test_fetch_url_rejects_when_allowed_url_hosts_empty(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(name="prod", master="yarn", allowed_url_hosts=[])
    )
    with pytest.raises(ValueError, match="allowed_url_hosts is empty"):
        fetch_url.fetch_url("http://anything.com/", "prod")


def test_fetch_url_truncates_body_over_1mb(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            allowed_url_hosts=["*.prod.internal"],
        )
    )
    big = "x" * (fetch_url._MAX_BODY_BYTES + 1)
    resp = httpx.Response(200, text=big)
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp):
        out = fetch_url.fetch_url("http://nm01.prod.internal/big", "prod")
    assert out.truncated is True
    assert len(out.body) == fetch_url._MAX_BODY_BYTES


def test_fetch_url_passes_auth_from_connection(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(
            name="auth",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            auth_type="basic",
            auth_user="u",
            auth_password="p",
            allowed_url_hosts=["*.prod.internal"],
        )
    )
    resp = httpx.Response(200, text="ok")
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        fetch_url.fetch_url("http://nm01.prod.internal:8042/node", "auth")
    auth = m.call_args.kwargs["auth"]
    assert isinstance(auth, httpx.BasicAuth)
    import base64
    creds = base64.b64decode(auth._auth_header.split()[1]).decode()
    assert creds == "u:p"


def test_fetch_url_passes_ssl_verify_from_connection(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(
            name="insecure",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            ssl_verify=False,
            allowed_url_hosts=["*.prod.internal"],
        )
    )
    resp = httpx.Response(200, text="ok")
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        fetch_url.fetch_url("http://nm01.prod.internal:8042/node", "insecure")
    assert m.call_args.kwargs["verify"] is False


def test_fetch_url_follows_redirects(tmp_path, monkeypatch):
    _fresh_stores(tmp_path, monkeypatch)
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            allowed_url_hosts=["*.prod.internal"],
        )
    )
    resp = httpx.Response(200, text="ok")
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        fetch_url.fetch_url("http://nm01.prod.internal:8042/node", "prod")
    assert m.call_args.kwargs["follow_redirects"] is True

def test_fetch_url_allows_host_matching_glob_pattern(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="ccam",
            master="yarn",
            yarn_rm_url="http://ccam1:8088",
            allowed_url_hosts=["ccam*"],
        )
    )
    resp = httpx.Response(200, text="hello")
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        out = fetch_url.fetch_url("http://ccam50:8088/foo", "ccam")
    assert out.status_code == 200
    assert out.body == "hello"
    assert m.call_count == 1

def test_fetch_url_allows_host_matching_any_of_multiple_globs(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
            allowed_url_hosts=["ccam*", "*.prod.internal"],
        )
    )
    resp = httpx.Response(200, text="hello")
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        out = fetch_url.fetch_url("http://history.prod.internal:18080/api/v1/info", "prod")
    assert out.status_code == 200
    assert out.body == "hello"
    assert m.call_count == 1

def test_fetch_url_glob_does_not_match_unrelated_host(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="ccam",
            master="yarn",
            yarn_rm_url="http://ccam1:8088",
            allowed_url_hosts=["ccam*"],
        )
    )
    with pytest.raises(ValueError, match="is not in Connection.allowed_url_hosts"):
        fetch_url.fetch_url("http://evil.com/foo", "ccam")

def test_fetch_url_glob_does_not_cross_dot_boundary(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="ccam",
            master="yarn",
            yarn_rm_url="http://ccam1:8088",
            allowed_url_hosts=["ccam*"],
        )
    )
    with pytest.raises(ValueError, match="is not in Connection.allowed_url_hosts"):
        fetch_url.fetch_url("http://ccam50.evil.com/", "ccam")

def test_fetch_url_glob_match_does_not_require_suffix_overlap(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm:8088",
            allowed_url_hosts=["ccam*"],
        )
    )
    resp = httpx.Response(200, text="hello")
    with patch("spark_executor.tools.fetch_url.httpx.get", return_value=resp) as m:
        out = fetch_url.fetch_url("http://ccam50:8088/", "prod")
    assert out.status_code == 200
    assert out.body == "hello"
    assert m.call_count == 1

def test_fetch_url_empty_allowed_hosts_rejects_everything(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal",
            allowed_url_hosts=[],
        )
    )
    with pytest.raises(ValueError, match="allowed_url_hosts is empty"):
        fetch_url.fetch_url("http://nm.prod.internal/", "prod")

def test_fetch_url_omitted_allowed_url_hosts_defaults_to_empty_and_rejects(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal",
        )
    )
    with pytest.raises(ValueError, match="allowed_url_hosts is empty"):
        fetch_url.fetch_url("http://nm.prod.internal/", "prod")

def test_fetch_url_error_message_hints_at_allowed_url_hosts(fresh_stores):
    fetch_url.conn_store.save(
        Connection(
            name="prod",
            master="yarn",
            yarn_rm_url="http://rm.prod.internal:8088",
        )
    )
    with pytest.raises(ValueError, match="set Connection.allowed_url_hosts"):
        fetch_url.fetch_url("http://evil.com/foo", "prod")