import hashlib
import os
import shutil
import subprocess
import sys
import tempfile
import pytest

from app.remediation.self_repair.schemas import (
    MissionFailureSnapshot,
    ShadowStatus,
)
from app.remediation.self_repair.shadow_orchestrator import ShadowSelfRepairOrchestrator
from app.remediation.self_repair.telemetry_contract import (
    AuthenticTelemetryEvaluator,
    SCOPE_RAW_SOCKET,
    SCOPE_URLLIB_HTTP,
)


@pytest.fixture
def temp_env():
    ws = tempfile.mkdtemp(prefix="ar82_ws_")
    rep = tempfile.mkdtemp(prefix="ar82_rep_")
    yield ws, rep
    shutil.rmtree(ws, ignore_errors=True)
    shutil.rmtree(rep, ignore_errors=True)


def test_telemetry_provenance_naked_string_blocked(temp_env):
    """
    AR-82: Proves that a naked string claiming 'FALSE_VERIFIED' in error_context
    or mission data without signed TelemetryAuditRecord evaluates to UNKNOWN_TELEMETRY
    and blocks auto-promotion.
    """
    ws, rep = temp_env
    orch = ShadowSelfRepairOrchestrator(base_reports_dir=rep, project_root=ws)

    # Mission snapshot with naked claim
    snapshot = MissionFailureSnapshot(
        mission_id="m_naked_prov",
        workspace_root=ws,
        mission_status="FAILED",
        error_context={"provider_called": "FALSE_VERIFIED", "network_used": "FALSE_VERIFIED"},
    )

    # During promotion check (require_authenticated_provenance=True), naked claim degrades to UNKNOWN
    prov, net, reason = orch.reconcile_telemetry(
        snapshot,
        {"provider_called": "FALSE_VERIFIED", "network_used": "FALSE_VERIFIED"},
        require_authenticated_provenance=True,
    )
    assert reason == "UNKNOWN_TELEMETRY"
    assert prov is None
    assert net is None


def test_telemetry_provenance_authenticated_record_accepted(temp_env):
    """
    AR-82: Proves that a genuine signed TelemetryAuditRecord from AuthenticTelemetryEvaluator
    is verified and accepted for promotion.
    """
    ws, rep = temp_env
    orch = ShadowSelfRepairOrchestrator(base_reports_dir=rep, project_root=ws)

    audit_rec = AuthenticTelemetryEvaluator.evaluate_telemetry(
        mission_id="m_auth_prov",
        instance_id="inst_auth_prov",
        workspace_root=ws,
        observer_active=True,
        monitored_scopes=[SCOPE_URLLIB_HTTP, SCOPE_RAW_SOCKET],
        detected_attempts=[],
        required_scopes={SCOPE_URLLIB_HTTP, SCOPE_RAW_SOCKET},
    )

    snapshot = MissionFailureSnapshot(
        mission_id="m_auth_prov",
        workspace_root=ws,
        mission_status="FAILED",
    )

    # Supply authentic signed audit record in repair_res
    prov, net, reason = orch.reconcile_telemetry(
        snapshot,
        {
            "provider_called": "FALSE_VERIFIED",
            "network_used": "FALSE_VERIFIED",
            "telemetry_audit": audit_rec.to_dict(),
        },
        require_authenticated_provenance=True,
    )
    assert reason is None
    assert prov is False
    assert net is False