import json
import subprocess
from pathlib import Path


ROOT = Path(__file__).resolve().parents[2]
COMPOSE = ROOT / "deploy/docker/docker-compose.yml"


def _config():
    result = subprocess.run(
        [
            "docker",
            "compose",
            "-f",
            str(COMPOSE),
            "config",
            "--format",
            "json",
        ],
        cwd=ROOT,
        check=True,
        capture_output=True,
        text=True,
    )
    return json.loads(result.stdout)


def test_runner_is_independent_bounded_and_not_exposed_to_kestra():
    config = _config()
    runner = config["services"]["runner"]
    kestra = config["services"]["kestra"]

    assert runner["ports"] == [
        {
            "mode": "ingress",
            "target": 5600,
            "published": "15600",
            "host_ip": "127.0.0.1",
            "protocol": "tcp",
        }
    ]
    assert runner["environment"]["RUNNER_WORKERS"] == "2"
    assert runner["environment"]["RUNNER_DATASOURCE_POOL_SIZE"] == "1"
    assert runner["environment"]["RUNNER_DATASOURCE_MAX_OVERFLOW"] == "1"
    assert runner["environment"]["RUNNER_DATASOURCE_MAX_IDLE_POOLS"] == "4"
    assert runner["read_only"] is True
    assert runner["pids_limit"] == 128
    assert runner["deploy"]["resources"]["limits"]["cpus"] == 1.0
    assert runner["deploy"]["resources"]["limits"]["memory"] == "536870912"
    assert runner["deploy"]["resources"]["limits"]["pids"] == 128
    assert not any(
        "/var/run/docker.sock" in str(volume)
        for volume in runner.get("volumes", [])
    )
    assert "dataops-runner" in runner["networks"]["dataops-test-net"][
        "aliases"
    ]

    kestra_json = json.dumps(kestra, sort_keys=True)
    for forbidden in (
        "RUNNER_TASK_TOKEN_SECRET",
        "DATASOURCE_CREDENTIAL_MASTER_KEY",
        "source-test-password",
        "source-postgres",
        "source-mysql",
    ):
        assert forbidden not in kestra_json