from __future__ import annotations

import secrets

from govoplan_core.core.object_storage import (
    StorageBackendError,
    configured_storage_backend,
)
from govoplan_core.core.operations import OperationalCheck
from govoplan_core.settings import settings as core_settings
from govoplan_campaign.backend.runtime import get_settings


def generated_eml_storage_check() -> OperationalCheck:
    """Verify Campaign evidence against the deployment object-store boundary."""

    storage = configured_storage_backend(get_settings() or core_settings)
    probe = f"campaign-artifacts/.health/{secrets.token_hex(16)}.probe"
    payload = secrets.token_bytes(64)
    try:
        storage.put_bytes(probe, payload, content_type="application/octet-stream")
        if storage.get_bytes(probe) != payload:
            raise OSError("generated EML persistence returned different bytes")
    except (OSError, StorageBackendError) as exc:
        return OperationalCheck(
            id="campaign.generated_eml_storage",
            label="Generated Campaign EML evidence",
            state="error",
            detail=(
                "The generated EML object store failed a bounded write/read probe "
                f"({type(exc).__name__})."
            ),
            readiness_critical=True,
            metrics={"backend": storage.name},
        )
    finally:
        try:
            storage.delete(probe)
        except StorageBackendError:
            pass

    node_local = storage.name == "local"
    return OperationalCheck(
        id="campaign.generated_eml_storage",
        label="Generated Campaign EML evidence",
        state="warning" if node_local else "ok",
        detail=(
            "Generated EML passed the object-store write/read/delete probe. "
            + (
                "The configured backend is node-local and is suitable only for a single-node profile."
                if node_local
                else "The configured backend is shared across application and worker nodes."
            )
        ),
        metrics={"backend": storage.name},
    )