"""Seed OpenStack identity and sample cloud resources."""

from __future__ import annotations

from asyncpg import Connection

from app.openstack.ids import oid
from app.security.auth import hash_secret


async def seed_openstack(conn: Connection, *, password: str = "secret") -> dict[str, object]:
    """Idempotent OpenStack lab seed (admin + demo project/user + sample resources)."""

    domain_id = oid("domain:Default")
    admin_project = oid("project:admin")
    demo_project = oid("project:demo")
    admin_user = oid("user:admin")
    demo_user = oid("user:demo")
    role_admin = oid("role:admin")
    role_member = oid("role:member")
    pw = hash_secret(password, salt=b"openstack-sim-v1")

    await conn.execute(
        """INSERT INTO os_domains(id, name, description, enabled)
           VALUES($1, 'Default', 'Default domain', true)
           ON CONFLICT (id) DO NOTHING""",
        domain_id,
    )
    await conn.execute(
        """INSERT INTO os_projects(id, domain_id, name, description, enabled) VALUES
           ($1, $3, 'admin', 'Admin project', true),
           ($2, $3, 'demo', 'Demo project', true)
           ON CONFLICT (id) DO NOTHING""",
        admin_project,
        demo_project,
        domain_id,
    )
    await conn.execute(
        """INSERT INTO os_users(id, domain_id, name, password_hash, enabled) VALUES
           ($1, $3, 'admin', $4, true),
           ($2, $3, 'demo', $4, true)
           ON CONFLICT (id) DO NOTHING""",
        admin_user,
        demo_user,
        domain_id,
        pw,
    )
    await conn.execute(
        """INSERT INTO os_roles(id, name) VALUES
           ($1, 'admin'), ($2, 'member')
           ON CONFLICT (id) DO NOTHING""",
        role_admin,
        role_member,
    )
    await conn.execute(
        """INSERT INTO os_role_assignments(id, role_id, user_id, project_id) VALUES
           ($1, $3, $5, $7),
           ($2, $4, $6, $8)
           ON CONFLICT (role_id, user_id, project_id) DO NOTHING""",
        oid("assign:admin-admin"),
        oid("assign:demo-member"),
        role_admin,
        role_member,
        admin_user,
        demo_user,
        admin_project,
        demo_project,
    )
    # admin also admin on demo for convenience
    await conn.execute(
        """INSERT INTO os_role_assignments(id, role_id, user_id, project_id)
           VALUES($1, $2, $3, $4)
           ON CONFLICT (role_id, user_id, project_id) DO NOTHING""",
        oid("assign:admin-demo-admin"),
        role_admin,
        admin_user,
        demo_project,
    )

    flavors = [
        ("1", "m1.tiny", 1, 512, 1),
        ("2", "m1.small", 1, 2048, 20),
        ("3", "m1.medium", 2, 4096, 40),
        ("4", "m1.large", 4, 8192, 80),
    ]
    for fid, name, vcpus, ram, disk in flavors:
        await conn.execute(
            """INSERT INTO os_flavors(id, name, vcpus, ram, disk, is_public)
               VALUES($1, $2, $3, $4, $5, true)
               ON CONFLICT (id) DO NOTHING""",
            fid,
            name,
            vcpus,
            ram,
            disk,
        )

    cirros = oid("image:cirros")
    ubuntu = oid("image:ubuntu")
    await conn.execute(
        """INSERT INTO os_images(id, name, status, visibility, size, disk_format,
               container_format, owner_project_id)
           VALUES
           ($1, 'cirros', 'active', 'public', 13287936, 'qcow2', 'bare', $3),
           ($2, 'ubuntu-22.04', 'active', 'public', 400000000, 'qcow2', 'bare', $3)
           ON CONFLICT (id) DO NOTHING""",
        cirros,
        ubuntu,
        admin_project,
    )

    demo_net = oid("net:demo-net")
    await conn.execute(
        """INSERT INTO os_networks(id, project_id, name, status, shared, admin_state_up)
           VALUES($1, $2, 'demo-net', 'ACTIVE', false, true)
           ON CONFLICT (id) DO NOTHING""",
        demo_net,
        demo_project,
    )
    demo_subnet = oid("subnet:demo-subnet")
    await conn.execute(
        """INSERT INTO os_subnets(id, network_id, project_id, name, cidr, ip_version, gateway_ip)
           VALUES($1, $2, $3, 'demo-subnet', '10.0.0.0/24', 4, '10.0.0.1')
           ON CONFLICT (id) DO NOTHING""",
        demo_subnet,
        demo_net,
        demo_project,
    )

    vol = oid("volume:demo-vol")
    await conn.execute(
        """INSERT INTO os_volumes(id, project_id, name, status, size, volume_type, bootable)
           VALUES($1, $2, 'demo-volume', 'available', 10, 'lvmdriver-1', false)
           ON CONFLICT (id) DO NOTHING""",
        vol,
        demo_project,
    )

    server = oid("server:demo-1")
    await conn.execute(
        """INSERT INTO os_servers(id, project_id, user_id, name, status, flavor_id, image_id, addresses, metadata)
           VALUES($1, $2, $3, 'demo-instance', 'ACTIVE', '2', $4,
                  $5::jsonb, $6::jsonb)
           ON CONFLICT (id) DO NOTHING""",
        server,
        demo_project,
        demo_user,
        cirros,
        '{"demo-net":[{"OS-EXT-IPS-MAC:mac_addr":"fa:16:3e:00:00:01","version":4,"addr":"10.0.0.12","OS-EXT-IPS:type":"fixed"}]}',
        '{"env":"lab","_tags":["lab","env","demo"]}',
    )

    await seed_openstack_extras(conn)

    from app.openstack.pack_seed import seed_pack_surface_samples
    from app.openstack.seed_discovery import seed_discovery_documents

    await seed_discovery_documents(conn)
    await seed_pack_surface_samples(conn, per_type=3)

    # Minimal topology tables (011+) — ignore if migration not applied yet.
    try:
        await conn.execute(
            """INSERT INTO os_availability_zones(name, zone_state)
               VALUES('nova', '{"available": true}'::jsonb)
               ON CONFLICT (name) DO NOTHING"""
        )
        await conn.execute(
            """INSERT INTO os_hypervisors(
                   id, hypervisor_hostname, state, status, host_ip, vcpus, vcpus_used,
                   memory_mb, memory_mb_used, local_gb, local_gb_used, running_vms,
                   service_host, availability_zone)
               VALUES(1,'compute-1','up','enabled','10.20.0.10',64,1,262144,2048,2000,20,1,'compute-1','nova')
               ON CONFLICT (id) DO NOTHING"""
        )
        await conn.execute(
            """INSERT INTO os_demo_meta(key, value) VALUES('profile','minimal')
               ON CONFLICT (key) DO UPDATE SET value=EXCLUDED.value, updated_at=now()"""
        )
    except Exception:
        pass

    return {
        "domain": "Default",
        "users": ["admin", "demo"],
        "password": password,
        "projects": ["admin", "demo"],
        "sample_server": "demo-instance",
        "profile": "minimal",
    }


async def seed_openstack_extras(conn: Connection) -> None:
    """Seed routers, SG, ironic nodes, LB, heat stack, swift objects, generic services."""

    import json
    from uuid import uuid4

    demo_project = oid("project:demo")
    admin_project = oid("project:admin")
    demo_user = oid("user:demo")

    # default security group
    sg = oid("sg:demo-default")
    await conn.execute(
        """INSERT INTO os_security_groups(id, project_id, name, description)
           VALUES($1,$2,'default','Default security group') ON CONFLICT (id) DO NOTHING""",
        sg,
        demo_project,
    )
    for direction, proto, pmin, pmax, prefix in (
        ("egress", None, None, None, None),
        ("ingress", "tcp", 22, 22, "0.0.0.0/0"),
        ("ingress", "icmp", None, None, "0.0.0.0/0"),
    ):
        await conn.execute(
            """INSERT INTO os_security_group_rules(id, security_group_id, project_id, direction, ethertype, protocol, port_range_min, port_range_max, remote_ip_prefix)
               VALUES($1,$2,$3,$4,'IPv4',$5,$6,$7,$8) ON CONFLICT (id) DO NOTHING""",
            oid(f"sgrule:{direction}:{proto}:{pmin}"),
            sg,
            demo_project,
            direction,
            proto,
            pmin,
            pmax,
            prefix,
        )

    await conn.execute(
        """INSERT INTO os_routers(id, project_id, name, status, admin_state_up, external_gateway_info)
           VALUES($1,$2,'demo-router','ACTIVE',true,NULL) ON CONFLICT (id) DO NOTHING""",
        oid("router:demo"),
        demo_project,
    )

    await conn.execute(
        """INSERT INTO os_nodes(id, name, driver, provision_state, power_state, resource_class, properties, driver_info, ports)
           VALUES($1,'baremetal-1','ipmi','available','power off','baremetal',
                  '{"cpus":64,"memory_mb":262144,"local_gb":2000}'::jsonb,'{}'::jsonb,'[]'::jsonb)
           ON CONFLICT (id) DO NOTHING""",
        oid("node:baremetal-1"),
    )

    await conn.execute(
        """INSERT INTO os_loadbalancers(id, project_id, name, description, vip_address, provisioning_status, operating_status)
           VALUES($1,$2,'demo-lb','Seed LB','10.0.0.50','ACTIVE','ONLINE')
           ON CONFLICT (id) DO NOTHING""",
        oid("lb:demo"),
        demo_project,
    )

    await conn.execute(
        """INSERT INTO os_stacks(id, project_id, stack_name, stack_status, description, template, parameters, outputs)
           VALUES($1,$2,'demo-stack','CREATE_COMPLETE','Seed stack','{"heat_template_version":"2015-04-30"}'::jsonb,'{}'::jsonb,'[]'::jsonb)
           ON CONFLICT (id) DO NOTHING""",
        oid("stack:demo"),
        demo_project,
    )

    for project in (demo_project, admin_project):
        account = f"AUTH_{project}"
        await conn.execute(
            """INSERT INTO os_swift_containers(account, name, meta)
               VALUES($1,'images','{}'::jsonb) ON CONFLICT DO NOTHING""",
            account,
        )
        await conn.execute(
            """INSERT INTO os_swift_objects(id, account, container, name, content_type, bytes, body, meta)
               VALUES($1,$2,'images','readme.txt','text/plain',12,$3,'{}'::jsonb)
               ON CONFLICT (account, container, name) DO NOTHING""",
            oid(f"swift:readme:{account}"),
            account,
            b"hello swift\n",
        )

    for user_id, key_name in ((demo_user, "demo-key"), (oid("user:admin"), "admin-key")):
        await conn.execute(
            """INSERT INTO os_keypairs(name, user_id, fingerprint, public_key, type)
               VALUES($1,$2,$3,$4,'ssh')
               ON CONFLICT DO NOTHING""",
            key_name,
            user_id,
            f"https://example.invalid/{key_name}",
            f"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC {key_name}@lab",
        )

    # Sample objects for every remaining service collection
    samples = [
        (
            "barbican",
            "secret",
            "demo-secret",
            {"payload_content_type": "text/plain", "secret_type": "passphrase"},
        ),
        (
            "manila",
            "share",
            "demo-share",
            {"size": 10, "share_proto": "NFS", "status": "available"},
        ),
        (
            "designate",
            "zone",
            "example.lab.",
            {"email": "hostmaster@example.lab", "ttl": 3600, "type": "PRIMARY"},
        ),
        (
            "magnum",
            "cluster",
            "demo-k8s",
            {"coe": "kubernetes", "status": "CREATE_COMPLETE", "node_count": 2},
        ),
        ("zun", "container", "demo-ctr", {"image": "cirros", "status": "Running"}),
        (
            "trove",
            "instance",
            "demo-db",
            {"datastore": {"type": "mysql", "version": "8.0"}, "status": "ACTIVE"},
        ),
        (
            "mistral",
            "workflow",
            "demo-wf",
            {"input": {}, "definition": "version: '2.0'\ndemo_wf:\n  tasks: {}"},
        ),
        (
            "aodh",
            "alarm",
            "cpu-high",
            {"type": "threshold", "state": "ok", "severity": "avg(cpu)>80"},
        ),
        (
            "freezer",
            "job",
            "daily-backup",
            {"description": "lab backup job", "status": "scheduled"},
        ),
        (
            "blazar",
            "lease",
            "demo-lease",
            {"start_date": "2026-01-01T00:00:00", "end_date": "2026-12-31T00:00:00"},
        ),
        ("vitrage", "alarm", "host-down", {"type": "host", "state": "critical"}),
        (
            "masakari",
            "segment",
            "az-segment",
            {"recovery_method": "auto", "service_type": "compute"},
        ),
        ("tacker", "vnf", "demo-vnf", {"status": "ACTIVE", "vnfd_id": "vnfd-1"}),
        ("adjutant", "task", "invite-user", {"task_type": "create_user", "status": "open"}),
        ("adjutant", "token", "adj-token-demo", {"status": "active"}),
        ("adjutant", "notification", "adj-notif-demo", {"status": "sent"}),
        (
            "adjutant",
            "status",
            "adj-status-demo",
            {"status": "UP", "service": "adjutant", "state": "up"},
        ),
        ("cloudkitty", "hashmap_service", "compute", {"name": "compute"}),
        (
            "heat-cfn",
            "stack",
            "demo-cfn",
            {"StackName": "demo-cfn", "StackStatus": "CREATE_COMPLETE"},
        ),
        ("watcher", "audit", "demo-audit", {"state": "SUCCEEDED"}),
        ("zaqar", "queue", "demo-queue", {"_default_message_ttl": 3600}),
        (
            "masakari",
            "host",
            "compute-1",
            {"name": "compute-1", "type": "compute", "reserved": False},
        ),
        ("designate", "recordset", "www", {"type": "A", "records": ["203.0.113.10"], "ttl": 3600}),
        # Extra types that pack lists expose and previously relied on lazy fixtures.
        ("barbican", "container", "demo-container", {"type": "generic", "status": "ACTIVE"}),
        ("barbican", "order", "demo-order", {"type": "key", "status": "ACTIVE"}),
        ("barbican", "secret_store", "demo-store", {"status": "ACTIVE"}),
        ("manila", "share_type", "default", {"is_public": True}),
        ("manila", "share_network", "demo-share-net", {"status": "active"}),
        ("manila", "share_snapshot", "demo-share-snap", {"status": "available", "size": 10}),
        ("manila", "share_server", "demo-share-srv", {"status": "active"}),
        ("manila", "security_service", "demo-sec-svc", {"type": "ldap", "status": "new"}),
        ("manila", "share_group", "demo-share-grp", {"status": "available"}),
        ("manila", "share_replica", "demo-share-rep", {"status": "available"}),
        ("designate", "tld", "lab", {"name": "lab"}),
        ("designate", "blacklist", "bad-pattern", {"pattern": "^bad\\..*"}),
        ("designate", "pool", "default", {"name": "default"}),
        ("designate", "service_status", "dns-central", {"status": "UP"}),
        ("magnum", "clustertemplate", "k8s-default", {"coe": "kubernetes", "image_id": "cirros"}),
        ("magnum", "certificate", "demo-cert", {"cluster_uuid": "demo-k8s"}),
        ("zun", "capsule", "demo-capsule", {"status": "Running", "cpu": 1, "memory": 512}),
        ("zun", "host", "zun-compute-1", {"hostname": "zun-compute-1", "state": "up"}),
        ("zun", "image", "nginx", {"image": "nginx", "status": "ACTIVE"}),
        (
            "zun",
            "service",
            "zun-compute",
            {"host": "zun-1", "binary": "zun-compute", "state": "up"},
        ),
        ("trove", "backup", "demo-db-bak", {"status": "COMPLETED", "size": 1.5}),
        ("trove", "cluster", "demo-db-cl", {"instance_count": 3}),
        ("trove", "configuration", "demo-db-cfg", {"datastore_name": "mysql"}),
        ("trove", "datastore", "mysql", {"name": "mysql", "version": "8.0"}),
        ("mistral", "action", "demo-action", {"is_system": False}),
        ("mistral", "cron_trigger", "hourly", {"pattern": "0 * * * *"}),
        ("mistral", "execution", "demo-exec", {"state": "SUCCESS"}),
        ("mistral", "task", "demo-task", {"state": "SUCCESS"}),
        ("mistral", "workbook", "demo-wb", {"definition": "version: '2.0'"}),
        ("aodh", "quota", "aodh-default", {"alarm": 100}),
        ("freezer", "action", "demo-freezer-action", {"status": "available"}),
        ("freezer", "backup", "demo-freezer-bak", {"status": "available"}),
        ("freezer", "client", "demo-freezer-client", {"status": "available"}),
        ("freezer", "session", "demo-freezer-session", {"status": "scheduled"}),
        ("blazar", "floatingip", "blazar-fip", {"floating_ip_address": "198.51.100.10"}),
        ("blazar", "host", "blazar-host-1", {"status": "available"}),
        ("vitrage", "event", "host-down-evt", {"type": "compute.host.down"}),
        ("vitrage", "resource", "vit-server", {"type": "nova.instance", "state": "ACTIVE"}),
        ("vitrage", "template", "vit-tmpl", {"type": "standard", "status": "active"}),
        ("vitrage", "topology", "vit-topo", {"nodes": [], "links": []}),
        ("masakari", "notification", "demo-notif", {"status": "finished"}),
        ("tacker", "vim", "demo-vim", {"type": "openstack", "status": "REACHABLE"}),
        ("tacker", "vnf_instance", "demo-vnf-inst", {"instantiationState": "INSTANTIATED"}),
        ("tacker", "vnf_package", "demo-vnf-pkg", {"onboardingState": "ONBOARDED"}),
        ("tacker", "vnfd", "demo-vnfd", {"name": "demo-vnfd"}),
        ("cloudkitty", "dataframes", "df-0", {"period": "3600"}),
        ("cloudkitty", "hashmap_field", "field-0", {"name": "field-0"}),
        ("cloudkitty", "report_summary", "summary-0", {"tenant_id": "demo"}),
        ("watcher", "action", "w-action-0", {"state": "SUCCEEDED"}),
        ("watcher", "action_plan", "ap-0", {"state": "SUCCEEDED"}),
        ("watcher", "audit_template", "at-0", {"goal": "server_consolidation"}),
        ("watcher", "goal", "goal-0", {"display_name": "Goal 0"}),
        ("watcher", "scoring_engine", "se-0", {"description": "engine 0"}),
        ("watcher", "service", "wsvc-0", {"host": "watcher-0", "status": "ACTIVE"}),
        ("watcher", "strategy", "strategy-0", {"goal_uuid": "goal-0"}),
        ("ironic", "driver", "ipmi", {"name": "ipmi", "hosts": ["simulator"], "type": "classic"}),
        (
            "ironic",
            "driver",
            "redfish",
            {"name": "redfish", "hosts": ["simulator"], "type": "classic"},
        ),
        (
            "neutron",
            "agent",
            "l3-agent",
            {"agent_type": "L3 agent", "host": "network-1", "alive": True, "admin_state_up": True},
        ),
        (
            "neutron",
            "agent",
            "ovs-agent",
            {
                "agent_type": "Open vSwitch agent",
                "host": "compute-1",
                "alive": True,
                "admin_state_up": True,
            },
        ),
        (
            "nova",
            "console_output",
            "default-console",
            {"output": "Booting...\nSimulator console\n"},
        ),
        (
            "nova",
            "console",
            "default-vnc",
            {"type": "novnc", "url": "https://127.0.0.1:6080/vnc_auto.html?token=simulator"},
        ),
        (
            "nova",
            "migration",
            "demo-mig",
            {
                "status": "completed",
                "migration_type": "migration",
                "source_compute": "compute-1",
                "dest_compute": "compute-2",
                "instance_uuid": str(oid("server:demo-1")),
            },
        ),
        (
            "nova",
            "server_topology",
            "demo-topo",
            {
                "server_id": str(oid("server:demo-1")),
                "nodes": [
                    {
                        "vcpu_set": [0],
                        "siblings": [[0]],
                        "host_node": 0,
                        "memory_mb": 2048,
                        "cpu_pinning": {},
                    }
                ],
                "pagesize_kb": 4,
                "host": "compute-1",
            },
        ),
        (
            "nova",
            "server_password",
            "demo-password",
            {"server_id": str(oid("server:demo-1")), "password": ""},
        ),
        (
            "placement",
            "resource_provider",
            "rp-0",
            {"name": "compute-1", "generation": 1},
        ),
        (
            "placement",
            "allocation",
            "alloc-demo",
            {
                "consumer_uuid": str(oid("server:demo-1")),
                "resource_provider": str(oid("placement:resource_provider:rp-0")),
                "resource_provider_id": str(oid("placement:resource_provider:rp-0")),
                "resources": {"VCPU": 1, "MEMORY_MB": 2048, "DISK_GB": 20},
                "consumer_generation": 1,
            },
        ),
        (
            "placement",
            "inventory",
            "inv-demo",
            {
                "resource_provider": str(oid("placement:resource_provider:rp-0")),
                "resource_provider_id": str(oid("placement:resource_provider:rp-0")),
                "resource_class": "VCPU",
                "total": 64,
                "reserved": 0,
            },
        ),
        (
            "placement",
            "aggregate",
            "agg-demo",
            {
                "name": "agg-demo",
                "resource_provider": str(oid("placement:resource_provider:rp-0")),
                "resource_provider_id": str(oid("placement:resource_provider:rp-0")),
            },
        ),
        (
            "nova",
            "console_auth_token",
            "demo-cat",
            {
                "token": "demo-console-token",
                "console_type": "novnc",
                "host": "127.0.0.1",
                "port": 6080,
                "internal_access_path": None,
            },
        ),
    ]
    for service, rtype, name, data in samples:
        item_id = oid(f"{service}:{rtype}:{name}")
        payload = {"id": str(item_id), "name": name, "status": data.get("status", "ACTIVE"), **data}
        await conn.execute(
            """INSERT INTO os_api_objects(id, service, resource_type, project_id, name, status, data)
               VALUES($1,$2,$3,$4,$5,$6,$7::jsonb)
               ON CONFLICT (id) DO NOTHING""",
            item_id,
            service,
            rtype,
            None,  # visible to any project-scoped token
            name,
            payload["status"],
            json.dumps(payload),
        )