"""Specialized IaaS handlers: auth, CRUD read-after-write, Nova actions.

Runs against a live api-gateway after minimal/demo seed. Prefers real service
ports when reachable; falls back to Keystone gateway + X-OpenStack-Route-Service.
"""

from __future__ import annotations

import json
import os
import urllib.error
import urllib.request
import uuid
from typing import Any

import pytest

pytestmark = pytest.mark.integration


def _probe(url: str, timeout: float = 2.0) -> bool:
    try:
        with urllib.request.urlopen(url, timeout=timeout) as res:
            return res.status == 200
    except Exception:
        return False


def _pick_keystone() -> str:
    candidates = [
        os.environ.get("OS_PROBE_HOST"),
        os.environ.get("OS_HOST"),
        "http://127.0.0.1:15000",
        "http://127.0.0.1:5000",
        "http://api-gateway:5000",
        "http://localhost:5000",
    ]
    for host in candidates:
        if not host:
            continue
        base = host.rstrip("/")
        if _probe(f"{base}/health/live") or _probe(f"{base}/v3"):
            return base
    return ""


KEYSTONE = _pick_keystone()

# Real OpenStack default ports (compose publishes 1:1; local override keeps them).
_PORTS = {
    "keystone": 5000,
    "nova": 8774,
    "neutron": 9696,
    "glance": 9292,
    "cinder": 8776,
    "placement": 8003,
    "heat": 8004,
    "swift": 8080,
    "ironic": 6385,
    "octavia": 9876,
}


def _service_base(service: str) -> tuple[str, str | None]:
    """Return (base_url, route_service_header_or_None)."""

    if service == "keystone":
        return KEYSTONE, None
    port = _PORTS[service]
    candidates = [port]
    if service == "swift":
        # Local override often maps Swift to host 18080.
        candidates = [18080, 8080]
    for p in candidates:
        base = f"http://127.0.0.1:{p}"
        # Any HTTP response (incl. 401/404) means the port is published.
        try:
            urllib.request.urlopen(base + "/", timeout=1)
            return base, None
        except urllib.error.HTTPError:
            return base, None
        except Exception:
            continue
    return KEYSTONE, service


@pytest.fixture(scope="module", autouse=True)
def _require_gateway():
    if not KEYSTONE:
        pytest.skip("OpenStack gateway unreachable")


def _request(
    method: str,
    service: str,
    path: str,
    *,
    token: str | None = None,
    data: dict[str, Any] | None = None,
    headers: dict[str, str] | None = None,
    raw_body: bytes | None = None,
) -> tuple[int, dict[str, str], Any]:
    base, route_svc = _service_base(service)
    body = raw_body
    hdrs = {"Accept": "application/json"}
    if data is not None:
        hdrs["Content-Type"] = "application/json"
        body = json.dumps(data).encode()
    if token:
        hdrs["X-Auth-Token"] = token
    if route_svc:
        hdrs["X-OpenStack-Route-Service"] = route_svc
    if headers:
        hdrs.update(headers)
    req = urllib.request.Request(f"{base}{path}", data=body, headers=hdrs, method=method)
    try:
        with urllib.request.urlopen(req, timeout=30) as res:
            raw = res.read().decode()
            try:
                parsed: Any = json.loads(raw) if raw else None
            except json.JSONDecodeError:
                parsed = raw
            return res.status, {k: v for k, v in res.headers.items()}, parsed
    except urllib.error.HTTPError as exc:
        raw = exc.read().decode()
        try:
            parsed = json.loads(raw) if raw else None
        except json.JSONDecodeError:
            parsed = raw
        return exc.code, {k: v for k, v in exc.headers.items()}, parsed


def _auth(
    *,
    user: str = "demo",
    project: str = "demo",
    password: str = "secret",
) -> tuple[str, str, dict[str, Any]]:
    status, headers, body = _request(
        "POST",
        "keystone",
        "/v3/auth/tokens",
        data={
            "auth": {
                "identity": {
                    "methods": ["password"],
                    "password": {
                        "user": {
                            "name": user,
                            "domain": {"name": "Default"},
                            "password": password,
                        }
                    },
                },
                "scope": {"project": {"name": project, "domain": {"name": "Default"}}},
            }
        },
    )
    token = headers.get("X-Subject-Token") or headers.get("x-subject-token")
    assert status == 201, (status, body)
    assert token
    project = ((body or {}).get("token") or {}).get("project") or {}
    project_id = str(project.get("id") or "")
    assert project_id
    return token, project_id, body or {}


@pytest.fixture(scope="module")
def auth_ctx() -> tuple[str, str, dict[str, Any]]:
    return _auth()


def test_keystone_token_catalog_ports(auth_ctx: tuple[str, str, dict[str, Any]]) -> None:
    _token, _pid, body = auth_ctx
    catalog = (body.get("token") or {}).get("catalog") or []
    by_type = {e.get("type"): e for e in catalog if isinstance(e, dict)}
    expected = {
        "identity": ":5000",
        "compute": ":8774",
        "network": ":9696",
        "image": ":9292",
        "volumev3": ":8776",
        "placement": ":8003",
        "orchestration": ":8004",
        "object-store": ":8080",
        "baremetal": ":6385",
        "load-balancer": ":9876",
    }
    for typ, port_frag in expected.items():
        entry = by_type.get(typ)
        assert entry, f"missing catalog type {typ}"
        urls = [
            ep.get("url") or ""
            for ep in entry.get("endpoints") or []
            if ep.get("interface") == "public"
        ]
        assert any(port_frag in u for u in urls), (typ, urls)


def test_specialized_lists_nonempty_after_seed(auth_ctx: tuple[str, str, dict[str, Any]]) -> None:
    token, pid, _ = auth_ctx
    checks = [
        ("nova", "/v2.1/servers/detail", "servers", {"OpenStack-API-Version": "compute 2.79"}),
        ("nova", "/v2.1/flavors", "flavors", None),
        ("neutron", "/v2.0/networks", "networks", None),
        ("neutron", "/v2.0/subnets", "subnets", None),
        ("neutron", "/v2.0/floatingips", "floatingips", None),
        ("glance", "/v2/images", "images", None),
        ("cinder", "/v3/volumes/detail", "volumes", None),
        (
            "placement",
            "/resource_providers",
            "resource_providers",
            {"OpenStack-API-Version": "placement 1.39"},
        ),
        ("heat", f"/v1/{pid}/stacks", "stacks", None),
        ("octavia", "/v2/lbaas/loadbalancers", "loadbalancers", None),
        ("ironic", "/v1/nodes", "nodes", {"OpenStack-API-Version": "baremetal 1.90"}),
    ]
    for service, path, key, hdrs in checks:
        status, _, body = _request("GET", service, path, token=token, headers=hdrs)
        assert status == 200, (service, path, status, body)
        items = (body or {}).get(key)
        assert isinstance(items, list) and len(items) >= 1, (service, path, key, body)

    status, _, body = _request("GET", "swift", f"/v1/AUTH_{pid}", token=token)
    assert status == 200
    assert isinstance(body, list) and len(body) >= 1


def test_nova_server_crud_and_actions(auth_ctx: tuple[str, str, dict[str, Any]]) -> None:
    token, _pid, _ = auth_ctx
    mv = {"OpenStack-API-Version": "compute 2.79"}
    st, _, flavors = _request("GET", "nova", "/v2.1/flavors", token=token)
    st, _, images = _request("GET", "glance", "/v2/images", token=token)
    st, _, nets = _request("GET", "neutron", "/v2.0/networks", token=token)
    flavor = (flavors or {}).get("flavors") or [{}]
    image = (images or {}).get("images") or [{}]
    networks = (nets or {}).get("networks") or [{}]
    # Prefer tenant demo-net over shared public for boot.
    net = next((n for n in networks if n.get("name") == "demo-net"), networks[0])
    name = f"lc-{uuid.uuid4().hex[:8]}"
    st, _, created = _request(
        "POST",
        "nova",
        "/v2.1/servers",
        token=token,
        headers=mv,
        data={
            "server": {
                "name": name,
                "flavorRef": flavor[0]["id"],
                "imageRef": image[0]["id"],
                "networks": [{"uuid": net["id"]}],
            }
        },
    )
    assert st == 202, created
    sid = (created or {}).get("server", {}).get("id")
    assert sid
    st, _, shown = _request("GET", "nova", f"/v2.1/servers/{sid}", token=token, headers=mv)
    assert st == 200
    assert shown["server"]["name"] == name

    st, _, _ = _request(
        "PUT",
        "nova",
        f"/v2.1/servers/{sid}",
        token=token,
        headers=mv,
        data={"server": {"name": f"{name}-ren"}},
    )
    assert st == 200

    for action, expect in (
        ({"os-stop": None}, "SHUTOFF"),
        ({"os-start": None}, "ACTIVE"),
        ({"reboot": {"type": "SOFT"}}, "ACTIVE"),
        ({"suspend": None}, "SUSPENDED"),
        ({"resume": None}, "ACTIVE"),
        ({"pause": None}, "PAUSED"),
        ({"unpause": None}, "ACTIVE"),
        ({"shelve": None}, "SHELVED"),
        ({"shelveOffload": None}, "SHELVED_OFFLOADED"),
        ({"unshelve": None}, "ACTIVE"),
    ):
        st, _, _ = _request(
            "POST",
            "nova",
            f"/v2.1/servers/{sid}/action",
            token=token,
            headers=mv,
            data=action,
        )
        assert st == 202, action
        st, _, shown = _request("GET", "nova", f"/v2.1/servers/{sid}", token=token, headers=mv)
        assert shown["server"]["status"] == expect, (action, shown["server"]["status"])

    st, _, _ = _request("DELETE", "nova", f"/v2.1/servers/{sid}", token=token, headers=mv)
    assert st == 204
    st, _, _ = _request("GET", "nova", f"/v2.1/servers/{sid}", token=token, headers=mv)
    assert st == 404


def test_neutron_network_subnet_port_fip_crud(
    auth_ctx: tuple[str, str, dict[str, Any]],
) -> None:
    token, _pid, _ = auth_ctx
    tag = uuid.uuid4().hex[:8]
    st, _, created = _request(
        "POST",
        "neutron",
        "/v2.0/networks",
        token=token,
        data={"network": {"name": f"n-{tag}", "admin_state_up": True}},
    )
    assert st == 201
    nid = created["network"]["id"]
    st, _, sub = _request(
        "POST",
        "neutron",
        "/v2.0/subnets",
        token=token,
        data={
            "subnet": {
                "name": f"s-{tag}",
                "network_id": nid,
                "cidr": "10.210.0.0/24",
                "ip_version": 4,
            }
        },
    )
    assert st == 201
    sid = sub["subnet"]["id"]
    st, _, port = _request(
        "POST",
        "neutron",
        "/v2.0/ports",
        token=token,
        data={"port": {"name": f"p-{tag}", "network_id": nid}},
    )
    assert st == 201
    pid = port["port"]["id"]

    st, _, nets = _request("GET", "neutron", "/v2.0/networks", token=token)
    assert any(n.get("id") == nid for n in nets.get("networks") or [])
    public = next(n for n in nets["networks"] if n.get("name") == "public")
    assert public.get("router:external") is True

    st, _, fip = _request(
        "POST",
        "neutron",
        "/v2.0/floatingips",
        token=token,
        data={"floatingip": {"floating_network_id": public["id"]}},
    )
    assert st == 201
    fid = fip["floatingip"]["id"]
    st, _, shown = _request("GET", "neutron", f"/v2.0/floatingips/{fid}", token=token)
    assert st == 200
    assert shown["floatingip"]["id"] == fid

    st, _, _ = _request("DELETE", "neutron", f"/v2.0/floatingips/{fid}", token=token)
    assert st == 204
    st, _, _ = _request("DELETE", "neutron", f"/v2.0/ports/{pid}", token=token)
    assert st == 204
    st, _, _ = _request("DELETE", "neutron", f"/v2.0/subnets/{sid}", token=token)
    assert st == 204
    st, _, _ = _request("DELETE", "neutron", f"/v2.0/networks/{nid}", token=token)
    assert st == 204
    st, _, _ = _request("GET", "neutron", f"/v2.0/networks/{nid}", token=token)
    assert st == 404


def test_glance_cinder_heat_octavia_ironic_swift_crud(
    auth_ctx: tuple[str, str, dict[str, Any]],
) -> None:
    token, project_id, _ = auth_ctx
    tag = uuid.uuid4().hex[:8]

    st, _, img = _request(
        "POST",
        "glance",
        "/v2/images",
        token=token,
        data={"name": f"img-{tag}", "container_format": "bare", "disk_format": "qcow2"},
    )
    assert st == 201
    iid = img["id"]
    st, _, shown = _request("GET", "glance", f"/v2/images/{iid}", token=token)
    assert st == 200 and shown["id"] == iid
    st, _, _ = _request("DELETE", "glance", f"/v2/images/{iid}", token=token)
    assert st == 204

    st, _, vol = _request(
        "POST",
        "cinder",
        "/v3/volumes",
        token=token,
        data={"volume": {"size": 1, "name": f"vol-{tag}"}},
    )
    assert st == 202
    vid = vol["volume"]["id"]
    st, _, shown = _request("GET", "cinder", f"/v3/volumes/{vid}", token=token)
    assert st == 200 and shown["volume"]["id"] == vid
    st, _, _ = _request(
        "PUT",
        "cinder",
        f"/v3/volumes/{vid}",
        token=token,
        data={"volume": {"name": f"vol-{tag}-ren", "description": "lc"}},
    )
    assert st == 200
    st, _, _ = _request("DELETE", "cinder", f"/v3/volumes/{vid}", token=token)
    assert st == 202
    st, _, _ = _request("GET", "cinder", f"/v3/volumes/{vid}", token=token)
    assert st == 404

    st, _, stack = _request(
        "POST",
        "heat",
        f"/v1/{project_id}/stacks",
        token=token,
        data={
            "stack_name": f"stk-{tag}",
            "template": {"heat_template_version": "2015-04-30", "resources": {}},
        },
    )
    assert st == 201
    sid = stack["stack"]["id"]
    sname = stack["stack"]["stack_name"]
    st, _, _ = _request(
        "PUT",
        "heat",
        f"/v1/{project_id}/stacks/{sname}/{sid}",
        token=token,
        data={
            "template": {
                "heat_template_version": "2015-04-30",
                "description": "upd",
                "resources": {},
            },
            "description": "updated",
        },
    )
    assert st == 200
    st, _, shown = _request("GET", "heat", f"/v1/{project_id}/stacks/{sname}/{sid}", token=token)
    assert st == 200
    assert shown["stack"]["stack_status"] == "UPDATE_COMPLETE"
    st, _, _ = _request("DELETE", "heat", f"/v1/{project_id}/stacks/{sname}/{sid}", token=token)
    assert st == 204

    st, _, subs = _request("GET", "neutron", "/v2.0/subnets", token=token)
    sub_id = (subs.get("subnets") or [{}])[0].get("id")
    assert sub_id
    st, _, lb = _request(
        "POST",
        "octavia",
        "/v2/lbaas/loadbalancers",
        token=token,
        data={"loadbalancer": {"name": f"lb-{tag}", "vip_subnet_id": sub_id}},
    )
    assert st == 201
    lbid = lb["loadbalancer"]["id"]
    st, _, _ = _request(
        "PUT",
        "octavia",
        f"/v2/lbaas/loadbalancers/{lbid}",
        token=token,
        data={"loadbalancer": {"name": f"lb-{tag}-ren"}},
    )
    assert st == 200
    st, _, _ = _request("DELETE", "octavia", f"/v2/lbaas/loadbalancers/{lbid}", token=token)
    assert st == 204
    st, _, _ = _request("GET", "octavia", f"/v2/lbaas/loadbalancers/{lbid}", token=token)
    assert st == 404

    st, _, node = _request(
        "POST",
        "ironic",
        "/v1/nodes",
        token=token,
        headers={"OpenStack-API-Version": "baremetal 1.90"},
        data={"name": f"node-{tag}", "driver": "ipmi"},
    )
    assert st == 201
    nuid = node["uuid"]
    st, _, _ = _request(
        "PUT",
        "ironic",
        f"/v1/nodes/{nuid}/states/power",
        token=token,
        headers={"OpenStack-API-Version": "baremetal 1.90"},
        data={"target": "power on"},
    )
    assert st == 202
    st, _, shown = _request(
        "GET",
        "ironic",
        f"/v1/nodes/{nuid}",
        token=token,
        headers={"OpenStack-API-Version": "baremetal 1.90"},
    )
    assert shown.get("power_state") == "power on"
    st, _, _ = _request(
        "DELETE",
        "ironic",
        f"/v1/nodes/{nuid}",
        token=token,
        headers={"OpenStack-API-Version": "baremetal 1.90"},
    )
    assert st == 204

    acct = f"AUTH_{project_id}"
    cname = f"c-{tag}"
    st, _, _ = _request("PUT", "swift", f"/v1/{acct}/{cname}", token=token)
    assert st == 201
    st, _, _ = _request(
        "PUT",
        "swift",
        f"/v1/{acct}/{cname}/hello.txt",
        token=token,
        headers={"Content-Type": "text/plain"},
        raw_body=b"hello",
    )
    assert st == 201
    st, _, obj = _request("GET", "swift", f"/v1/{acct}/{cname}/hello.txt", token=token)
    assert st == 200
    st, _, _ = _request("DELETE", "swift", f"/v1/{acct}/{cname}/hello.txt", token=token)
    assert st == 204
    st, _, _ = _request("DELETE", "swift", f"/v1/{acct}/{cname}", token=token)
    assert st == 204
    st, _, containers = _request("GET", "swift", f"/v1/{acct}", token=token)
    assert st == 200
    assert not any(c.get("name") == cname for c in containers or [])


def test_project_scoped_token_required_for_nova() -> None:
    status, headers, body = _request(
        "POST",
        "keystone",
        "/v3/auth/tokens",
        data={
            "auth": {
                "identity": {
                    "methods": ["password"],
                    "password": {
                        "user": {
                            "name": "demo",
                            "domain": {"name": "Default"},
                            "password": "secret",
                        }
                    },
                }
            }
        },
    )
    token = headers.get("X-Subject-Token") or headers.get("x-subject-token")
    assert status == 201 and token
    st, _, err = _request("GET", "nova", "/v2.1/servers", token=token)
    assert st in {401, 403}
    assert isinstance(err, dict)