"""
Drift Adopt Service — ADR-057: Gitea PR API 實作
=================================================
職責：將合法漂移反向寫回 Git，透過 Gitea PR API 而非直接 git push

設計邊界（核心原則）：
- 不直接操作 git（不 git add/commit/push）
- 透過 Gitea REST API 建立 branch + commit + PR
- PR 需 SRE 手動 review 後 merge（不自動 merge main）
- 只修改漂移相關的 YAML 欄位（不 add -A）

流程：
  adopt() 被呼叫
    → 讀取 k8s/ 目錄對應 YAML 檔
    → 建立 drift/adopt-{report_id[:8]}-{ts} branch
    → 透過 Gitea API commit YAML 更新
    → 建立 PR + 推送 Telegram 通知

版本: v1.0
建立: 2026-04-05 (台北時區)
建立者: Claude Code (ADR-057 實作)
關聯 ADR: ADR-057
"""

from __future__ import annotations

import base64
import pathlib
from typing import TYPE_CHECKING

import httpx
import structlog

from src.core.config import get_settings
from src.utils.timezone import now_taipei

if TYPE_CHECKING:
    from src.models.drift import DriftInterpretation, DriftReport

logger = structlog.get_logger(__name__)


class DriftAdoptService:
    """
    透過 Gitea PR API 將漂移寫回 Git

    ADR-057 安全設計：
    ✅ 使用 Gitea API（不在 API Pod 內執行 git）
    ✅ 建立 PR 讓 SRE review（不直接 push main）
    ✅ 只 commit k8s/ 目錄的 YAML（不 git add -A）
    ✅ API Token 從 K8s Secret 注入（不寫死）
    """

    def __init__(self) -> None:
        settings = get_settings()
        self._api_url = settings.GITEA_API_URL.rstrip("/")
        self._token = settings.GITEA_API_TOKEN
        self._owner = settings.GITEA_REPO_OWNER
        self._repo = settings.GITEA_REPO_NAME
        self._k8s_dir = pathlib.Path("k8s")

    async def auto_adopt_if_safe(self, report: "DriftReport") -> dict:
        """
        低風險 drift 自動採納（2026-04-24 ogt + Claude Sonnet 4.6）

        自動採納條件（全部滿足）：
        1. high_count == 0（無 HIGH drift）
        2. medium_count <= 5（MEDIUM drift 不超過 5 項）
        3. actionable_count <= 10（非白名單非 trivial 項目不超過 10）
        4. interpretation.confidence >= 0.70（意圖確定性足夠）
        5. interpretation.intent NOT IN {unknown}（必須有明確意圖）
        6. interpretation.risk NOT IN {HIGH, CRITICAL}（非高風險）

        不滿足任一條件 → return {"success": False, "reason": "...", "skipped": True}
        自動採納 PR title 加 [AUTO] 前綴，通知標示「請 SRE 複核後 merge」

        Returns:
            {"success": bool, "skipped": bool, "reason": str, "pr_url": str | None}
              skipped=True  → 條件不符，人工卡片照舊推送
              skipped=False → 嘗試了，但 Gitea API 失敗
        """
        interp = report.interpretation

        # 條件 1: 無 HIGH drift
        if report.high_count > 0:
            return {
                "success": False,
                "skipped": True,
                "reason": f"存在 {report.high_count} 項 HIGH drift，不自動採納",
                "pr_url": None,
            }

        # 條件 2: MEDIUM 不超過 5 項
        if report.medium_count > 5:
            return {
                "success": False,
                "skipped": True,
                "reason": f"MEDIUM drift {report.medium_count} 項超過上限 5，不自動採納",
                "pr_url": None,
            }

        # 條件 3: actionable 不超過 10（過濾白名單 + trivial）
        actionable_items = [
            item for item in report.items
            if not item.is_allowlisted
            and not self._is_trivial_drift(item.git_value, item.actual_value)
        ]
        actionable_count = len(actionable_items)
        if actionable_count > 10:
            return {
                "success": False,
                "skipped": True,
                "reason": f"可操作漂移 {actionable_count} 項超過上限 10，不自動採納",
                "pr_url": None,
            }

        # 條件 4 / 5 / 6: 需要有 interpretation
        if not interp:
            return {
                "success": False,
                "skipped": True,
                "reason": "尚無 Nemotron 意圖分析，不自動採納",
                "pr_url": None,
            }

        if interp.confidence < 0.70:
            return {
                "success": False,
                "skipped": True,
                "reason": f"意圖信心 {interp.confidence:.0%} < 70%，不自動採納",
                "pr_url": None,
            }

        if interp.intent.value == "unknown":
            return {
                "success": False,
                "skipped": True,
                "reason": "Nemotron 意圖為 unknown，不自動採納",
                "pr_url": None,
            }

        if interp.risk.upper() in ("HIGH", "CRITICAL"):
            return {
                "success": False,
                "skipped": True,
                "reason": f"Nemotron 風險評估為 {interp.risk}，不自動採納",
                "pr_url": None,
            }

        logger.info(
            "drift_auto_adopt_eligible",
            report_id=report.report_id,
            medium_count=report.medium_count,
            actionable=actionable_count,
            intent=interp.intent.value,
            confidence=interp.confidence,
            risk=interp.risk,
        )

        # 通過全部條件 → 執行採納（suppress_notification=True 避免與下方通知重複）
        result = await self.adopt(report, field_description="[AUTO] 低風險自動採納", suppress_notification=True)
        if result.get("success"):
            # 通知 SRE：無按鈕，標示需複核
            await self._notify_auto_adopt_telegram(result["pr_url"], report, actionable_count, interp)

        return {
            "success": result.get("success", False),
            "skipped": False,
            "reason": result.get("message", ""),
            "pr_url": result.get("pr_url"),
        }

    @staticmethod
    def _is_trivial_drift(git_val, actual_val) -> bool:
        """
        判斷是否為 K8s controller 自動補齊的噪音
        （與 DriftNarratorService._is_trivial_drift 邏輯一致）
        """
        def _is_empty(v) -> bool:
            if v is None:
                return True
            s = str(v).strip()
            return s in ("", "{}", "[]", "null", "None", "false", "False", "0")
        return _is_empty(git_val) and _is_empty(actual_val)

    async def _notify_auto_adopt_telegram(
        self,
        pr_url: str,
        report: "DriftReport",
        actionable_count: int,
        interp: "DriftInterpretation",
    ) -> None:
        """
        自動採納成功後的無按鈕 Telegram 通知（TYPE-1 純資訊）
        標示「已自動建立 PR，請 SRE 複核後 merge」
        """
        try:
            from src.services.telegram_gateway import get_telegram_gateway
            tg = get_telegram_gateway()
            message = (
                f"Namespace: {report.namespace}\n"
                f"漂移摘要: {report.summary}（可操作 {actionable_count} 項）\n"
                f"Nemotron 意圖: {interp.intent.value} | 信心: {interp.confidence:.0%} | 風險: {interp.risk}\n\n"
                f"PR: {pr_url}\n\n"
                f"請 SRE 複核後 merge。"
            )
            await tg.send_info_notification(
                incident_id=report.report_id,
                title="Config Drift 已自動採納（低風險）",
                message=message,
                alertname="ConfigDriftAutoAdopt",
                severity="info",
            )
        except Exception as e:
            logger.warning("drift_auto_adopt_telegram_failed", error=str(e))

    # =========================================================================
    # Public: 人工按鈕觸發入口
    # =========================================================================

    async def adopt_drift(self, report_id: str) -> dict:
        """
        2026-04-20 ogt + Claude Opus 4.7: Telegram 按鈕呼叫入口
        從 DB 載入 DriftReport 後委派給 adopt()。
        telegram_gateway._handle_drift_action 呼叫此方法。
        """
        from src.repositories.drift_repository import get_drift_repository
        report = await get_drift_repository().get(report_id)
        if not report:
            return {"success": False, "message": f"Report {report_id} not found"}
        return await self.adopt(report)

    async def adopt(self, report: "DriftReport", field_description: str = "", suppress_notification: bool = False) -> dict:
        """
        將漂移寫回 Git：建立 branch + commit + PR

        Args:
            report: 漂移報告（含具體 drift items）
            field_description: 漂移欄位說明（用於 PR title）

        Returns:
            {"success": bool, "pr_url": str, "message": str}
        """
        if not self._token:
            return {
                "success": False,
                "message": "GITEA_API_TOKEN 未設定，請在 K8s Secret 中新增此 key",
                "pr_url": None,
            }

        ts = now_taipei().strftime("%Y%m%d%H%M%S")
        branch_name = f"drift/adopt-{report.report_id[:8]}-{ts}"
        pr_title = f"chore: adopt drift — {report.namespace} {field_description or report.summary}"

        logger.info(
            "drift_adopt_start",
            report_id=report.report_id,
            branch=branch_name,
        )

        try:
            async with httpx.AsyncClient(timeout=30.0) as client:
                headers = {
                    "Authorization": f"token {self._token}",
                    "Content-Type": "application/json",
                }

                # Step 1: 取得 main branch 的最新 SHA
                main_sha = await self._get_main_sha(client, headers)
                if not main_sha:
                    return {"success": False, "message": "無法取得 main branch SHA", "pr_url": None}

                # Step 2: 建立新 branch
                branch_ok = await self._create_branch(client, headers, branch_name, main_sha)
                if not branch_ok:
                    return {"success": False, "message": f"建立 branch {branch_name} 失敗", "pr_url": None}

                # Step 3: 找出受影響的 YAML 檔並 commit 更新
                committed_files = await self._commit_drift_yaml(client, headers, branch_name, report)
                if not committed_files:
                    return {
                        "success": False,
                        "message": "無直接匹配的 YAML 檔，未建立零 diff 承認 PR",
                        "pr_url": None,
                    }

                # Step 4: 建立 PR
                pr_url = await self._create_pr(
                    client, headers, branch_name, pr_title, report, committed_files
                )
                if not pr_url:
                    return {"success": False, "message": "建立 PR 失敗", "pr_url": None}

                # Step 5: 推送 Telegram 通知（auto_adopt_if_safe 會自己發，避免重複）
                if not suppress_notification:
                    await self._notify_telegram(pr_url, report, pr_title)

                logger.info("drift_adopt_pr_created", report_id=report.report_id, pr_url=pr_url)
                return {
                    "success": True,
                    "message": "PR 已建立，請 SRE review 後 merge",
                    "pr_url": pr_url,
                }

        except Exception as e:
            logger.error("drift_adopt_failed", report_id=report.report_id, error=str(e))
            return {"success": False, "message": f"adopt 失敗: {str(e)}", "pr_url": None}

    # =========================================================================
    # Private helpers
    # =========================================================================

    async def _get_main_sha(self, client: httpx.AsyncClient, headers: dict) -> str | None:
        """取得 main branch 最新 commit SHA"""
        resp = await client.get(
            f"{self._api_url}/api/v1/repos/{self._owner}/{self._repo}/branches/main",
            headers=headers,
        )
        if resp.status_code == 200:
            return resp.json()["commit"]["id"]
        logger.error("drift_adopt_get_main_sha_failed", status=resp.status_code)
        return None

    async def _create_branch(
        self, client: httpx.AsyncClient, headers: dict, branch_name: str, main_sha: str
    ) -> bool:
        """建立新 branch"""
        resp = await client.post(
            f"{self._api_url}/api/v1/repos/{self._owner}/{self._repo}/branches",
            headers=headers,
            json={"new_branch_name": branch_name, "old_branch_name": "main"},
        )
        if resp.status_code in (200, 201):
            return True
        logger.error("drift_adopt_create_branch_failed", status=resp.status_code, body=resp.text[:200])
        return False

    async def _commit_drift_yaml(
        self, client: httpx.AsyncClient, headers: dict, branch_name: str, report: "DriftReport"
    ) -> list[str]:
        """
        找出受漂移影響的 YAML 檔，更新實際值後 commit 到 branch

        目前策略：標記 YAML 檔為「已承認漂移」（加注解），
        等 ADR-057 Phase 2 再實作精確 YAML patch 邏輯。
        """
        committed = []
        affected_kinds = {
            item.resource_kind.lower()
            for item in report.items
            if not item.is_allowlisted
        }

        for yaml_file in sorted(self._k8s_dir.rglob("*.yaml")):
            if not yaml_file.is_file():
                continue
            # 判斷此 YAML 是否與漂移相關
            file_stem = yaml_file.stem.lower()
            if not any(kind in file_stem for kind in affected_kinds):
                continue

            try:
                content = yaml_file.read_text()

                # 取得 Gitea 上的 file SHA（用於 update API）
                file_sha = await self._get_file_sha(client, headers, str(yaml_file))

                # 在檔案末尾加入漂移承認注解
                from src.utils.timezone import now_taipei as _now
                ts_str = _now().strftime("%Y-%m-%d %H:%M:%S +0800")
                annotation = (
                    f"\n# [drift-adopted] {ts_str}\n"
                    f"# Report: {report.report_id}\n"
                    f"# Namespace: {report.namespace}\n"
                    f"# Summary: {report.summary}\n"
                )
                updated_content = content + annotation
                encoded = base64.b64encode(updated_content.encode()).decode()

                # Commit 到 branch
                payload = {
                    "message": f"chore(drift): adopt {report.namespace} drift — {yaml_file.name}",
                    "content": encoded,
                    "branch": branch_name,
                }
                if file_sha:
                    payload["sha"] = file_sha

                url = f"{self._api_url}/api/v1/repos/{self._owner}/{self._repo}/contents/{yaml_file}"
                resp = await client.put(url, headers=headers, json=payload)
                if resp.status_code in (200, 201):
                    committed.append(str(yaml_file))
                    logger.info("drift_adopt_file_committed", file=str(yaml_file))
                else:
                    logger.warning("drift_adopt_file_commit_failed", file=str(yaml_file), status=resp.status_code)

            except Exception as e:
                logger.warning("drift_adopt_file_error", file=str(yaml_file), error=str(e))

        return committed

    async def _get_file_sha(
        self, client: httpx.AsyncClient, headers: dict, file_path: str
    ) -> str | None:
        """取得 Gitea 上檔案的 SHA（update 時需要）"""
        resp = await client.get(
            f"{self._api_url}/api/v1/repos/{self._owner}/{self._repo}/contents/{file_path}",
            headers=headers,
            params={"ref": "main"},
        )
        if resp.status_code == 200:
            return resp.json().get("sha")
        return None

    async def _create_pr(
        self,
        client: httpx.AsyncClient,
        headers: dict,
        branch_name: str,
        pr_title: str,
        report: "DriftReport",
        committed_files: list[str],
    ) -> str | None:
        """建立 Pull Request，回傳 PR URL"""
        files_md = "\n".join(f"- `{f}`" for f in committed_files) if committed_files else "（無直接匹配的 YAML 檔）"

        intent_label = "❓ 意圖不明"
        if report.interpretation:
            intent_map = {
                "emergency_hotfix": "🚨 緊急 Hotfix",
                "human_error": "⚠️ 人為誤操作",
                "automated_change": "🤖 系統自動變更",
                "unknown": "❓ 意圖不明",
            }
            intent_label = intent_map.get(report.interpretation.intent.value, "❓ 意圖不明")

        body = (
            f"## Config Drift 承認\n\n"
            f"**Report ID**: `{report.report_id}`\n"
            f"**Namespace**: `{report.namespace}`\n"
            f"**漂移摘要**: {report.summary}\n"
            f"**Nemotron 意圖**: {intent_label}\n"
            f"{f'**說明**: {report.interpretation.explanation}' if report.interpretation else ''}\n\n"
            f"## 異動檔案\n\n{files_md}\n\n"
            f"## 說明\n\n"
            f"此 PR 由 AWOOOI Config Drift Detection 系統自動建立。\n"
            f"承認此次 K8s 漂移為合法變更，將漂移狀態寫回 Git。\n\n"
            f"> **SRE 確認事項**:\n"
            f"> - [ ] 確認漂移是預期的合法變更\n"
            f"> - [ ] 確認 YAML 注解正確反映變更意圖\n"
            f"> - [ ] merge 後手動更新 K8s YAML 的實際差異值\n"
        )

        resp = await client.post(
            f"{self._api_url}/api/v1/repos/{self._owner}/{self._repo}/pulls",
            headers=headers,
            json={
                "title": pr_title,
                "body": body,
                "head": branch_name,
                "base": "main",
            },
        )
        if resp.status_code in (200, 201):
            pr_data = resp.json()
            return pr_data.get("html_url") or pr_data.get("url")
        logger.error("drift_adopt_create_pr_failed", status=resp.status_code, body=resp.text[:300])
        return None

    async def _notify_telegram(self, pr_url: str, report: "DriftReport", pr_title: str) -> None:
        """推送 Telegram 通知 SRE"""
        try:
            from src.services.telegram_gateway import get_telegram_gateway
            tg = get_telegram_gateway()
            await tg.send_text(
                f"📋 <b>Config Drift 承認 PR 已建立</b>\n"
                f"Namespace: {report.namespace}\n"
                f"漂移: {report.summary}\n\n"
                f"PR: {pr_url}\n\n"
                f"請 SRE review 後 merge。"
            )
        except Exception as e:
            logger.warning("drift_adopt_telegram_failed", error=str(e))


# =============================================================================
# Singleton
# =============================================================================

_adopt_service: DriftAdoptService | None = None


def get_drift_adopt_service() -> DriftAdoptService:
    global _adopt_service
    if _adopt_service is None:
        _adopt_service = DriftAdoptService()
    return _adopt_service