"""Section 12 — Releases & Release Packager: 7-layer test suite.

Layer 1 Unit
  - TestUnitParseChangelog: _parse_changelog happy/edge/malformed paths
  - TestUnitParseSemanticReport: _parse_semantic_report round-trip and failure modes
  - TestUnitBuildDownloadUrls: packager URL construction
  - TestUnitBuildEmptyDownloadUrls: empty URL sentinel
  - TestUnitIsPrerelease: is_prerelease derived from channel

Layer 2 Integration
  - TestIntegrationCreateRelease: tag uniqueness, channel validation, semver fields stored
  - TestIntegrationListReleases: newest-first order, draft exclusion, channel filter
  - TestIntegrationGetByTag: found / not found
  - TestIntegrationDeleteByTag: returns True/False, cascade to assets
  - TestIntegrationAssets: attach, list, remove, download count increment

Layer 3 E2E
  - TestE2EReleaseLifecycle: HTTP create → get → list → attach asset → download stats → delete asset
  - TestE2EDuplicateTag: second create with same tag → 409
  - TestE2EDraftRelease: draft excluded from list, visible with include_drafts
  - TestE2ECreateFromDict: create_release_from_dict wire format
  - TestE2ETags: list_tags endpoint, namespace extraction

Layer 4 Stress
  - TestStress: 30 releases, 20 assets on one release

Layer 5 Data Integrity
  - TestDataIntegrity: tag uniqueness per-repo (not cross-repo), asset FK cascade,
    download count atomic increment, semver fields persisted correctly

Layer 6 Security
  - TestSecurity: create/delete/attach endpoints require auth;
    private repo list/get/tags require auth; download tracking no auth for public

Layer 7 Performance
  - TestPerformance: list 100 releases <500ms, list 50 assets <200ms
"""
from __future__ import annotations

import secrets
import time
import pytest
from httpx import AsyncClient
from sqlalchemy.ext.asyncio import AsyncSession

from datetime import datetime, timezone

from muse.core.types import fake_id
from musehub.core.genesis import compute_identity_id, compute_release_id, compute_repo_id
from musehub.db.musehub_repo_models import MusehubRepo
from musehub.types.json_types import JSONObject, StrDict
from musehub.models.musehub import (
    ReleaseResponse,
    ChangelogEntryResponse,
    ReleaseDownloadUrls,
    SemanticReleaseReportResponse,
)
from musehub.services.musehub_release_packager import (
    build_download_urls,
    build_empty_download_urls,
)
from musehub.services.musehub_releases import (
    _parse_changelog,
    _parse_semantic_report,
)


# ===========================================================================
# Helpers
# ===========================================================================


def _uid() -> str:
    return secrets.token_hex(16)


async def _repo(
    session: AsyncSession,
    slug: str,
    owner: str = "alice",
    visibility: str = "public",
) -> MusehubRepo:
    owner_id = compute_identity_id(owner.encode())
    created_at = datetime.now(tz=timezone.utc)
    repo = MusehubRepo(
        repo_id=compute_repo_id(owner_id, slug, "code", created_at.isoformat()),
        name=slug,
        owner=owner,
        slug=slug,
        visibility=visibility,
        owner_user_id=owner_id,
        created_at=created_at,
        updated_at=created_at,
    )
    session.add(repo)
    await session.flush()
    await session.refresh(repo)
    return repo


async def _release(
    session: AsyncSession,
    repo_id: str,
    tag: str = "v1.0.0",
    *,
    channel: str = "stable",
    is_draft: bool = False,
    semver_major: int = 1,
    semver_minor: int = 0,
    semver_patch: int = 0,
) -> ReleaseResponse:
    from musehub.services import musehub_releases
    return await musehub_releases.create_release(
        session,
        repo_id=repo_id,
        tag=tag,
        commit_id=None,
        channel=channel,
        is_draft=is_draft,
        semver_major=semver_major,
        semver_minor=semver_minor,
        semver_patch=semver_patch,
    )


async def _api_repo(
    client: AsyncClient, auth_headers: StrDict, name: str, visibility: str = "public"
) -> str:
    r = await client.post(
        "/api/repos",
        json={"name": name, "owner": "testuser", "initialize": False, "visibility": visibility},
        headers=auth_headers,
    )
    assert r.status_code == 201, r.text
    return str(r.json()["repoId"])


async def _api_release(
    client: AsyncClient,
    auth_headers: StrDict,
    repo_id: str,
    tag: str = "v1.0.0",
    **kwargs: str | bool,
) -> JSONObject:
    payload = {"tag": tag, "channel": "stable", **kwargs}
    r = await client.post(
        f"/api/repos/{repo_id}/releases",
        json=payload,
        headers=auth_headers,
    )
    assert r.status_code == 201, r.text
    return dict(r.json())


# ===========================================================================
# Layer 1 — Unit tests
# ===========================================================================


class TestUnitParseChangelog:
    def test_valid_entries(self) -> None:
        raw = '[{"commit_id":"abc","message":"feat: add x","sem_ver_bump":"minor","breaking_changes":[],"author":"alice","timestamp":"2025-01-01"}]'
        entries = _parse_changelog(raw)
        assert len(entries) == 1
        assert entries[0].commit_id == "abc"
        assert entries[0].message == "feat: add x"
        assert entries[0].sem_ver_bump == "minor"

    def test_empty_json_array(self) -> None:
        assert _parse_changelog("[]") == []

    def test_invalid_json_returns_empty(self) -> None:
        assert _parse_changelog("{not valid json") == []

    def test_none_like_returns_empty(self) -> None:
        assert _parse_changelog("") == []

    def test_non_list_root_returns_empty(self) -> None:
        assert _parse_changelog('{"key": "value"}') == []

    def test_non_dict_items_skipped(self) -> None:
        raw = '[1, "string", {"commit_id":"x","message":"m"}]'
        entries = _parse_changelog(raw)
        assert len(entries) == 1
        assert entries[0].commit_id == "x"

    def test_missing_fields_default_to_empty(self) -> None:
        raw = '[{"commit_id":"y","message":"fix"}]'
        entries = _parse_changelog(raw)
        assert entries[0].sem_ver_bump == ""
        assert entries[0].breaking_changes == []
        assert entries[0].author == ""

    def test_breaking_changes_list(self) -> None:
        raw = '[{"commit_id":"z","message":"break","breaking_changes":["Drop support for X"]}]'
        entries = _parse_changelog(raw)
        assert entries[0].breaking_changes == ["Drop support for X"]

    def test_wrong_type_fields_handled(self) -> None:
        # breaking_changes is not a list — should default gracefully
        raw = '[{"commit_id":"a","message":"b","breaking_changes":"not-a-list"}]'
        entries = _parse_changelog(raw)
        assert entries[0].breaking_changes == []


class TestUnitParseSemanticReport:
    def test_valid_report_round_trips(self) -> None:
        report = SemanticReleaseReportResponse(
            total_files=10,
            semantic_files=8,
            total_symbols=42,
            human_commits=3,
            agent_commits=1,
        )
        raw = report.model_dump_json()
        parsed = _parse_semantic_report(raw)
        assert parsed is not None
        assert parsed.total_files == 10
        assert parsed.total_symbols == 42
        assert parsed.agent_commits == 1

    def test_empty_string_returns_none(self) -> None:
        assert _parse_semantic_report("") is None

    def test_invalid_json_returns_none(self) -> None:
        assert _parse_semantic_report("{bad json") is None

    def test_non_dict_returns_none(self) -> None:
        assert _parse_semantic_report("[1,2,3]") is None

    def test_partial_report_fills_defaults(self) -> None:
        raw = '{"total_files": 5}'
        parsed = _parse_semantic_report(raw)
        assert parsed is not None
        assert parsed.total_files == 5
        assert parsed.total_symbols == 0  # default

    def test_unknown_extra_fields_ignored(self) -> None:
        # Pydantic ignores extra fields by default
        raw = '{"total_files": 2, "unknown_future_field": "ignored"}'
        parsed = _parse_semantic_report(raw)
        assert parsed is not None
        assert parsed.total_files == 2


class TestUnitBuildDownloadUrls:
    def test_metadata_url_contains_repo_and_release(self) -> None:
        urls = build_download_urls("my-repo-id", "my-release-id")
        assert isinstance(urls, ReleaseDownloadUrls)
        assert urls.metadata is not None
        assert "my-repo-id" in urls.metadata
        assert "my-release-id" in urls.metadata

    def test_metadata_url_ends_with_metadata(self) -> None:
        urls = build_download_urls("r", "rel")
        assert urls.metadata is not None
        assert urls.metadata.endswith("/metadata")


class TestUnitBuildEmptyDownloadUrls:
    def test_all_fields_are_none(self) -> None:
        urls = build_empty_download_urls()
        assert isinstance(urls, ReleaseDownloadUrls)
        assert urls.metadata is None


class TestUnitIsPrerelease:
    def test_stable_channel_not_prerelease(self) -> None:
        from musehub.models.musehub import ReleaseResponse
        from datetime import datetime, timezone
        _now = datetime.now(tz=timezone.utc)
        r = ReleaseResponse(
            release_id=compute_release_id(fake_id("repo"), "v1.0.0", _now.isoformat()),
            tag="v1.0.0", channel="stable",
            download_urls=ReleaseDownloadUrls(),
            created_at=_now,
        )
        assert r.is_prerelease is False

    def test_beta_channel_is_prerelease(self) -> None:
        from musehub.models.musehub import ReleaseResponse
        from datetime import datetime, timezone
        _now = datetime.now(tz=timezone.utc)
        r = ReleaseResponse(
            release_id=compute_release_id(fake_id("repo"), "v2.0.0-beta.1", _now.isoformat()),
            tag="v2.0.0-beta.1", channel="beta",
            download_urls=ReleaseDownloadUrls(),
            created_at=_now,
        )
        assert r.is_prerelease is True

    def test_alpha_channel_is_prerelease(self) -> None:
        from musehub.models.musehub import ReleaseResponse
        from datetime import datetime, timezone
        _now = datetime.now(tz=timezone.utc)
        r = ReleaseResponse(
            release_id=compute_release_id(fake_id("repo"), "v3.0.0-alpha.1", _now.isoformat()),
            tag="v3.0.0-alpha.1", channel="alpha",
            download_urls=ReleaseDownloadUrls(),
            created_at=_now,
        )
        assert r.is_prerelease is True

    def test_nightly_channel_is_prerelease(self) -> None:
        from musehub.models.musehub import ReleaseResponse
        from datetime import datetime, timezone
        _now = datetime.now(tz=timezone.utc)
        r = ReleaseResponse(
            release_id=compute_release_id(fake_id("repo"), "v4.0.0-nightly", _now.isoformat()),
            tag="v4.0.0-nightly", channel="nightly",
            download_urls=ReleaseDownloadUrls(),
            created_at=_now,
        )
        assert r.is_prerelease is True


# ===========================================================================
# Layer 2 — Integration tests
# ===========================================================================


class TestIntegrationCreateRelease:
    async def test_creates_with_all_semver_fields(
        self, db_session: AsyncSession
    ) -> None:
        repo = await _repo(db_session, "semver-fields")
        r = await _release(
            db_session, repo.repo_id, "v3.2.1",
            semver_major=3, semver_minor=2, semver_patch=1,
        )
        assert r.semver_major == 3
        assert r.semver_minor == 2
        assert r.semver_patch == 1
        assert r.tag == "v3.2.1"

    async def test_duplicate_tag_raises_value_error(
        self, db_session: AsyncSession
    ) -> None:
        repo = await _repo(db_session, "dup-tag")
        await _release(db_session, repo.repo_id, "v1.0.0")
        with pytest.raises(ValueError, match="already exists"):
            await _release(db_session, repo.repo_id, "v1.0.0")

    async def test_invalid_channel_raises_value_error(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "bad-channel")
        with pytest.raises(ValueError, match="Unknown channel"):
            await musehub_releases.create_release(
                db_session, repo_id=repo.repo_id,
                tag="v1.0.0", commit_id=None, channel="underground",
            )

    async def test_valid_channels_accepted(
        self, db_session: AsyncSession
    ) -> None:
        for i, channel in enumerate(["stable", "beta", "alpha", "nightly"]):
            repo = await _repo(db_session, f"chan-{channel}")
            r = await _release(db_session, repo.repo_id, "v1.0.0", channel=channel)
            assert r.channel == channel

    async def test_semantic_report_stored_and_parsed(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "semreport")
        report = SemanticReleaseReportResponse(
            total_files=5, total_symbols=20, agent_commits=2
        )
        r = await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id,
            tag="v1.0.0", commit_id=None,
            semantic_report_json=report.model_dump_json(),
        )
        assert r.semantic_report is not None
        assert r.semantic_report.total_files == 5
        assert r.semantic_report.agent_commits == 2

    async def test_changelog_stored_and_parsed(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "changelog-stored")
        entry = ChangelogEntryResponse(
            commit_id="abc123", message="feat: new thing", sem_ver_bump="minor"
        )
        r = await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id,
            tag="v1.0.0", commit_id=None, changelog=[entry],
        )
        assert len(r.changelog) == 1
        assert r.changelog[0].commit_id == "abc123"


class TestIntegrationListReleases:
    async def test_newest_first_ordering(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "order-test")
        await _release(db_session, repo.repo_id, "v1.0.0")
        await _release(db_session, repo.repo_id, "v2.0.0")
        await _release(db_session, repo.repo_id, "v3.0.0")

        releases = await musehub_releases.list_releases(db_session, repo.repo_id)
        assert releases.releases[0].tag == "v3.0.0"
        assert releases.releases[-1].tag == "v1.0.0"

    async def test_drafts_excluded_by_default(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "draft-excl")
        await _release(db_session, repo.repo_id, "v1.0.0")
        await _release(db_session, repo.repo_id, "v2.0.0-draft", is_draft=True)

        releases = await musehub_releases.list_releases(db_session, repo.repo_id)
        assert releases.total == 1
        assert releases.releases[0].tag == "v1.0.0"

    async def test_drafts_included_when_requested(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "draft-incl")
        await _release(db_session, repo.repo_id, "v1.0.0")
        await _release(db_session, repo.repo_id, "v2.0.0-draft", is_draft=True)

        releases = await musehub_releases.list_releases(
            db_session, repo.repo_id, include_drafts=True
        )
        assert releases.total == 2

    async def test_channel_filter(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "chan-filter")
        await _release(db_session, repo.repo_id, "v1.0.0", channel="stable")
        await _release(db_session, repo.repo_id, "v2.0.0-beta.1", channel="beta")

        betas = await musehub_releases.list_releases(
            db_session, repo.repo_id, channel="beta"
        )
        assert betas.total == 1
        assert betas.releases[0].channel == "beta"


class TestIntegrationGetByTag:
    async def test_found_by_tag(self, db_session: AsyncSession) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "get-by-tag")
        await _release(db_session, repo.repo_id, "v5.0.0")
        result = await musehub_releases.get_release_by_tag(db_session, repo.repo_id, "v5.0.0")
        assert result is not None
        assert result.tag == "v5.0.0"

    async def test_not_found_returns_none(self, db_session: AsyncSession) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "get-by-tag-miss")
        result = await musehub_releases.get_release_by_tag(db_session, repo.repo_id, "v99.0.0")
        assert result is None


class TestIntegrationDeleteByTag:
    async def test_delete_returns_true_when_found(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "del-true")
        await _release(db_session, repo.repo_id, "v1.0.0")
        result = await musehub_releases.delete_release_by_tag(db_session, repo.repo_id, "v1.0.0")
        assert result is True

    async def test_delete_returns_false_when_not_found(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "del-false")
        result = await musehub_releases.delete_release_by_tag(db_session, repo.repo_id, "v9.9.9")
        assert result is False

    async def test_delete_removes_from_list(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "del-list")
        await _release(db_session, repo.repo_id, "v1.0.0")
        await musehub_releases.delete_release_by_tag(db_session, repo.repo_id, "v1.0.0")
        releases = await musehub_releases.list_releases(db_session, repo.repo_id)
        assert releases.total == 0


class TestIntegrationAssets:
    async def test_attach_and_list_asset(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "asset-attach")
        r = await _release(db_session, repo.repo_id, "v1.0.0")

        asset = await musehub_releases.attach_asset(
            db_session,
            release_id=r.release_id,
            repo_id=repo.repo_id,
            name="mpack.zip",
            label="MPack",
            content_type="application/zip",
            size=1024,
            download_url="https://cdn.example.com/mpack.zip",
        )
        assert asset.name == "mpack.zip"
        assert asset.size == 1024
        assert asset.download_count == 0

        assets = await musehub_releases.list_release_assets(
            db_session, r.release_id, "v1.0.0"
        )
        assert assets.release_id == r.release_id
        assert len(assets.assets) == 1

    async def test_download_count_increment(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "dl-count")
        r = await _release(db_session, repo.repo_id, "v1.0.0")
        asset = await musehub_releases.attach_asset(
            db_session,
            release_id=r.release_id,
            repo_id=repo.repo_id,
            name="file.zip",
            download_url="https://cdn.example.com/file.zip",
        )

        await musehub_releases.increment_asset_download_count(db_session, asset.asset_id)
        await musehub_releases.increment_asset_download_count(db_session, asset.asset_id)
        await db_session.flush()

        stats = await musehub_releases.get_download_stats(
            db_session, r.release_id, r.tag
        )
        assert stats.total_downloads == 2
        assert stats.assets[0].download_count == 2

    async def test_remove_asset_returns_true(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "asset-remove")
        r = await _release(db_session, repo.repo_id, "v1.0.0")
        asset = await musehub_releases.attach_asset(
            db_session,
            release_id=r.release_id,
            repo_id=repo.repo_id,
            name="to-remove.zip",
            download_url="https://cdn.example.com/rm.zip",
        )
        result = await musehub_releases.remove_asset(db_session, asset.asset_id)
        assert result is True

    async def test_remove_nonexistent_asset_returns_false(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        result = await musehub_releases.remove_asset(db_session, _uid())
        assert result is False

    async def test_increment_nonexistent_asset_returns_false(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        result = await musehub_releases.increment_asset_download_count(db_session, _uid())
        assert result is False


# ===========================================================================
# Layer 3 — E2E tests
# ===========================================================================


class TestE2EReleaseLifecycle:
    async def test_create_get_list(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-lifecycle")
        r = await _api_release(client, auth_headers, repo_id, "v1.0.0",
                               title="First Release", body="Initial release notes")
        assert r["tag"] == "v1.0.0"
        assert r["title"] == "First Release"
        assert r["channel"] == "stable"
        assert r["isPrerelease"] is False
        release_id = r["releaseId"]

        # GET by tag
        r2 = await client.get(f"/api/repos/{repo_id}/releases/v1.0.0")
        assert r2.status_code == 200
        assert r2.json()["releaseId"] == release_id

        # LIST
        r3 = await client.get(f"/api/repos/{repo_id}/releases")
        assert r3.status_code == 200
        releases = r3.json()["releases"]
        assert len(releases) == 1
        assert releases[0]["tag"] == "v1.0.0"

    async def test_attach_asset_and_download_stats(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-assets")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")

        # Attach asset
        r = await client.post(
            f"/api/repos/{repo_id}/releases/v1.0.0/assets",
            json={
                "name": "mpack.zip",
                "label": "Main MPack",
                "contentType": "application/zip",
                "size": 2048,
                "downloadUrl": "https://cdn.example.com/mpack.zip",
            },
            headers=auth_headers,
        )
        assert r.status_code == 201
        asset_id = r.json()["assetId"]
        assert r.json()["name"] == "mpack.zip"
        assert r.json()["downloadCount"] == 0

        # Record download
        r2 = await client.post(
            f"/api/repos/{repo_id}/releases/v1.0.0/assets/{asset_id}/download"
        )
        assert r2.status_code == 204

        # Get download stats
        r3 = await client.get(
            f"/api/repos/{repo_id}/releases/v1.0.0/downloads"
        )
        assert r3.status_code == 200
        data = r3.json()
        assert data["totalDownloads"] == 1
        assert data["assets"][0]["downloadCount"] == 1

    async def test_delete_asset(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-del-asset")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")

        r = await client.post(
            f"/api/repos/{repo_id}/releases/v1.0.0/assets",
            json={"name": "file.zip", "downloadUrl": "https://cdn.example.com/f.zip"},
            headers=auth_headers,
        )
        asset_id = r.json()["assetId"]

        r2 = await client.delete(
            f"/api/repos/{repo_id}/releases/v1.0.0/assets/{asset_id}",
            headers=auth_headers,
        )
        assert r2.status_code == 204

        # Asset list should be empty
        r3 = await client.get(f"/api/repos/{repo_id}/releases/v1.0.0/assets")
        assert r3.status_code == 200
        assert r3.json()["assets"] == []


class TestE2EDuplicateTag:
    async def test_second_create_same_tag_returns_409(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-dup-tag")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")

        r = await client.post(
            f"/api/repos/{repo_id}/releases",
            json={"tag": "v1.0.0"},
            headers=auth_headers,
        )
        assert r.status_code == 409


class TestE2EDraftRelease:
    async def test_draft_excluded_from_list(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-draft")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")
        await _api_release(client, auth_headers, repo_id, "v2.0.0", isDraft=True)

        r = await client.get(f"/api/repos/{repo_id}/releases")
        assert r.status_code == 200
        tags = [rel["tag"] for rel in r.json()["releases"]]
        assert "v1.0.0" in tags
        assert "v2.0.0" not in tags

    async def test_draft_accessible_by_tag(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-draft-get")
        await _api_release(client, auth_headers, repo_id, "v1.0.0-draft", isDraft=True)

        r = await client.get(f"/api/repos/{repo_id}/releases/v1.0.0-draft")
        assert r.status_code == 200
        assert r.json()["isDraft"] is True

    async def test_beta_channel_is_prerelease_in_response(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-beta")
        r = await _api_release(client, auth_headers, repo_id, "v2.0.0-beta.1", channel="beta")
        assert r["channel"] == "beta"
        assert r["isPrerelease"] is True


class TestE2ECreateFromDict:
    async def test_create_from_dict_minimal(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "from-dict-min")
        r = await musehub_releases.create_release_from_dict(
            db_session, repo.repo_id,
            {"tag": "v1.0.0", "title": "CLI Release"},
        )
        assert r.tag == "v1.0.0"
        assert r.title == "CLI Release"

    async def test_create_from_dict_missing_tag_raises(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "from-dict-notag")
        with pytest.raises(ValueError, match="missing required field 'tag'"):
            await musehub_releases.create_release_from_dict(
                db_session, repo.repo_id, {"title": "No tag"}
            )

    async def test_create_from_dict_full_payload(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "from-dict-full")
        data = {
            "tag": "v3.1.4",
            "title": "Full Release",
            "body": "Release notes here",
            "channel": "beta",
            "agent_id": "agent-1",
            "model_id": "claude-sonnet-4-6",
            "is_draft": False,
        }
        r = await musehub_releases.create_release_from_dict(db_session, repo.repo_id, data)
        assert r.tag == "v3.1.4"
        assert r.channel == "beta"
        assert r.agent_id == "agent-1"


class TestE2ETags:
    async def test_list_tags_returns_all_releases_as_tags(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-tags")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")
        await _api_release(client, auth_headers, repo_id, "v2.0.0")

        r = await client.get(f"/api/repos/{repo_id}/tags")
        assert r.status_code == 200
        tags = [t["tag"] for t in r.json()["tags"]]
        assert "v1.0.0" in tags
        assert "v2.0.0" in tags

    async def test_tag_namespace_version_for_semver(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-ns-ver")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")

        r = await client.get(f"/api/repos/{repo_id}/tags")
        assert r.status_code == 200
        tag_obj = next(t for t in r.json()["tags"] if t["tag"] == "v1.0.0")
        assert tag_obj["namespace"] == "version"

    async def test_unknown_tag_returns_404(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        repo_id = await _api_repo(client, auth_headers, "e2e-tag-404")
        r = await client.get(f"/api/repos/{repo_id}/releases/v99.0.0")
        assert r.status_code == 404


# ===========================================================================
# Layer 4 — Stress tests
# ===========================================================================


class TestStress:
    async def test_30_releases_sequential(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "stress-30")

        for i in range(30):
            await musehub_releases.create_release(
                db_session,
                repo_id=repo.repo_id,
                tag=f"v{i}.0.0",
                commit_id=None,
            )

        releases = await musehub_releases.list_releases(db_session, repo.repo_id)
        assert releases.total == 30

    async def test_20_assets_on_one_release(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "stress-assets")
        r = await _release(db_session, repo.repo_id, "v1.0.0")

        for i in range(20):
            await musehub_releases.attach_asset(
                db_session,
                release_id=r.release_id,
                repo_id=repo.repo_id,
                name=f"asset-{i}.zip",
                download_url=f"https://cdn.example.com/asset-{i}.zip",
            )

        assets = await musehub_releases.list_release_assets(db_session, r.release_id, "v1.0.0")
        assert len(assets.assets) == 20


# ===========================================================================
# Layer 5 — Data Integrity tests
# ===========================================================================


class TestDataIntegrity:
    async def test_tag_unique_per_repo_not_cross_repo(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        r1 = await _repo(db_session, "di-r1")
        r2 = await _repo(db_session, "di-r2")

        await _release(db_session, r1.repo_id, "v1.0.0")
        # Same tag in different repo is fine
        r = await musehub_releases.create_release(
            db_session, repo_id=r2.repo_id, tag="v1.0.0", commit_id=None
        )
        assert r.tag == "v1.0.0"

    async def test_semver_fields_persisted_correctly(
        self, db_session: AsyncSession
    ) -> None:
        from sqlalchemy import select as sa_select
        from musehub.db.musehub_release_models import MusehubRelease
        from musehub.services import musehub_releases

        repo = await _repo(db_session, "di-semver")
        r = await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id, tag="v4.5.6",
            commit_id=None,
            semver_major=4, semver_minor=5, semver_patch=6,
            semver_pre="rc.1", semver_build="20250101",
        )

        stmt = sa_select(MusehubRelease).where(MusehubRelease.release_id == r.release_id)
        row = (await db_session.execute(stmt)).scalar_one()
        assert row.semver_major == 4
        assert row.semver_minor == 5
        assert row.semver_patch == 6
        assert row.semver_pre == "rc.1"
        assert row.semver_build == "20250101"

    async def test_asset_cascade_deleted_with_release(
        self, db_session: AsyncSession
    ) -> None:
        from sqlalchemy import select as sa_select
        from musehub.db.musehub_release_models import MusehubReleaseAsset
        from musehub.services import musehub_releases

        repo = await _repo(db_session, "di-cascade")
        r = await _release(db_session, repo.repo_id, "v1.0.0")
        await musehub_releases.attach_asset(
            db_session,
            release_id=r.release_id,
            repo_id=repo.repo_id,
            name="file.zip",
            download_url="https://cdn.example.com/file.zip",
        )
        await db_session.commit()

        await musehub_releases.delete_release_by_tag(db_session, repo.repo_id, "v1.0.0")
        await db_session.commit()

        stmt = sa_select(MusehubReleaseAsset).where(
            MusehubReleaseAsset.release_id == r.release_id
        )
        assets = (await db_session.execute(stmt)).scalars().all()
        assert len(assets) == 0

    async def test_download_count_starts_at_zero(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "di-dl-zero")
        r = await _release(db_session, repo.repo_id, "v1.0.0")
        asset = await musehub_releases.attach_asset(
            db_session,
            release_id=r.release_id,
            repo_id=repo.repo_id,
            name="file.zip",
            download_url="https://cdn.example.com/file.zip",
        )
        assert asset.download_count == 0

    async def test_gpg_signature_persisted(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "di-gpg")
        sig = "-----BEGIN PGP SIGNATURE-----\nfake\n-----END PGP SIGNATURE-----"
        r = await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id, tag="v1.0.0",
            commit_id=None, gpg_signature=sig,
        )
        assert r.gpg_signature == sig

    async def test_is_draft_persisted(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "di-is-draft")
        r = await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id, tag="v1.0.0",
            commit_id=None, is_draft=True,
        )
        assert r.is_draft is True


# ===========================================================================
# Layer 6 — Security tests
# ===========================================================================


class TestSecurity:
    async def test_create_release_requires_auth(
        self, client: AsyncClient, db_session: AsyncSession
    ) -> None:
        repo = await _repo(db_session, "sec-create")
        await db_session.commit()
        r = await client.post(
            f"/api/repos/{repo.repo_id}/releases",
            json={"tag": "v1.0.0"},
        )
        assert r.status_code in (401, 403)

    async def test_attach_asset_requires_auth(
        self, client: AsyncClient, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "sec-attach")
        await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id, tag="v1.0.0", commit_id=None
        )
        await db_session.commit()
        r = await client.post(
            f"/api/repos/{repo.repo_id}/releases/v1.0.0/assets",
            json={"name": "f.zip", "downloadUrl": "https://cdn.example.com/f.zip"},
        )
        assert r.status_code in (401, 403)

    async def test_delete_asset_requires_auth(
        self, client: AsyncClient, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "sec-del-asset")
        r = await musehub_releases.create_release(
            db_session, repo_id=repo.repo_id, tag="v1.0.0", commit_id=None
        )
        asset = await musehub_releases.attach_asset(
            db_session, release_id=r.release_id, repo_id=repo.repo_id,
            name="f.zip", download_url="https://cdn.example.com/f.zip",
        )
        await db_session.commit()
        r2 = await client.delete(
            f"/api/repos/{repo.repo_id}/releases/v1.0.0/assets/{asset.asset_id}"
        )
        assert r2.status_code in (401, 403)

    async def test_private_repo_list_requires_auth(
        self, client: AsyncClient, db_session: AsyncSession
    ) -> None:
        repo = await _repo(db_session, "sec-private-list", visibility="private")
        await db_session.commit()
        r = await client.get(f"/api/repos/{repo.repo_id}/releases")
        assert r.status_code in (401, 403)

    async def test_public_repo_list_no_auth_needed(
        self, client: AsyncClient, db_session: AsyncSession
    ) -> None:
        repo = await _repo(db_session, "sec-public-list", visibility="public")
        await db_session.commit()
        r = await client.get(f"/api/repos/{repo.repo_id}/releases")
        assert r.status_code == 200

    async def test_download_tracking_no_auth_for_public(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        """Anonymous downloads should be tracked (no auth required)."""
        repo_id = await _api_repo(client, auth_headers, "sec-anon-dl")
        await _api_release(client, auth_headers, repo_id, "v1.0.0")
        r = await client.post(
            f"/api/repos/{repo_id}/releases/v1.0.0/assets",
            json={"name": "f.zip", "downloadUrl": "https://cdn.example.com/f.zip"},
            headers=auth_headers,
        )
        asset_id = r.json()["assetId"]

        # No auth headers — anonymous download
        r2 = await client.post(
            f"/api/repos/{repo_id}/releases/v1.0.0/assets/{asset_id}/download"
        )
        assert r2.status_code == 204

    async def test_unknown_repo_create_returns_404(
        self, client: AsyncClient, auth_headers: StrDict
    ) -> None:
        r = await client.post(
            f"/api/repos/{_uid()}/releases",
            json={"tag": "v1.0.0"},
            headers=auth_headers,
        )
        assert r.status_code == 404

    async def test_create_release_forbidden_for_non_owner(
        self, client: AsyncClient, auth_headers: StrDict, db_session: AsyncSession
    ) -> None:
        """POST /releases as a non-owner returns 403."""
        # "testuser" is the authenticated actor; repo owned by "other-owner".
        _other_id = compute_identity_id(b"other-owner")
        _now = datetime.now(tz=timezone.utc)
        other_repo = MusehubRepo(
            repo_id=compute_repo_id(_other_id, "other-release-repo", "code", _now.isoformat()),
            name="other-release-repo",
            owner="other-owner",
            slug="other-release-repo",
            visibility="public",
            owner_user_id=_other_id,
            created_at=_now,
            updated_at=_now,
        )
        db_session.add(other_repo)
        await db_session.commit()
        r = await client.post(
            f"/api/repos/{other_repo.repo_id}/releases",
            json={"tag": "v1.0.0"},
            headers=auth_headers,
        )
        assert r.status_code == 403

    async def test_attach_asset_forbidden_for_non_owner(
        self, client: AsyncClient, auth_headers: StrDict, db_session: AsyncSession
    ) -> None:
        """POST /releases/{tag}/assets as a non-owner returns 403."""
        from musehub.services import musehub_releases

        _other_id2 = compute_identity_id(b"other-owner")
        _now2 = datetime.now(tz=timezone.utc)
        other_repo = MusehubRepo(
            repo_id=compute_repo_id(_other_id2, "other-attach-repo", "code", _now2.isoformat()),
            name="other-attach-repo",
            owner="other-owner",
            slug="other-attach-repo",
            visibility="public",
            owner_user_id=_other_id2,
            created_at=_now2,
            updated_at=_now2,
        )
        db_session.add(other_repo)
        await db_session.flush()
        await musehub_releases.create_release(
            db_session, repo_id=other_repo.repo_id, tag="v1.0.0", commit_id=None
        )
        await db_session.commit()
        r = await client.post(
            f"/api/repos/{other_repo.repo_id}/releases/v1.0.0/assets",
            json={"name": "f.zip", "downloadUrl": "https://cdn.example.com/f.zip"},
            headers=auth_headers,
        )
        assert r.status_code == 403

    async def test_delete_asset_forbidden_for_non_owner(
        self, client: AsyncClient, auth_headers: StrDict, db_session: AsyncSession
    ) -> None:
        """DELETE /releases/{tag}/assets/{id} as a non-owner returns 403."""
        from musehub.services import musehub_releases

        _other_id3 = compute_identity_id(b"other-owner")
        _now3 = datetime.now(tz=timezone.utc)
        other_repo = MusehubRepo(
            repo_id=compute_repo_id(_other_id3, "other-del-asset-repo", "code", _now3.isoformat()),
            name="other-del-asset-repo",
            owner="other-owner",
            slug="other-del-asset-repo",
            visibility="public",
            owner_user_id=_other_id3,
            created_at=_now3,
            updated_at=_now3,
        )
        db_session.add(other_repo)
        await db_session.flush()
        release = await musehub_releases.create_release(
            db_session, repo_id=other_repo.repo_id, tag="v1.0.0", commit_id=None
        )
        asset = await musehub_releases.attach_asset(
            db_session,
            release_id=release.release_id,
            repo_id=other_repo.repo_id,
            name="f.zip",
            download_url="https://cdn.example.com/f.zip",
        )
        await db_session.commit()
        r = await client.delete(
            f"/api/repos/{other_repo.repo_id}/releases/v1.0.0/assets/{asset.asset_id}",
            headers=auth_headers,
        )
        assert r.status_code == 403


# ===========================================================================
# Layer 7 — Performance tests
# ===========================================================================


class TestPerformance:
    async def test_list_100_releases_under_500ms(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "perf-100")

        for i in range(100):
            await musehub_releases.create_release(
                db_session, repo_id=repo.repo_id,
                tag=f"v{i}.0.0", commit_id=None,
            )

        start = time.monotonic()
        releases = await musehub_releases.list_releases(db_session, repo.repo_id)
        elapsed = time.monotonic() - start

        assert releases.total == 100
        assert elapsed < 0.5, f"list_releases took {elapsed:.3f}s (limit 0.5s)"

    async def test_list_50_assets_under_200ms(
        self, db_session: AsyncSession
    ) -> None:
        from musehub.services import musehub_releases
        repo = await _repo(db_session, "perf-50-assets")
        r = await _release(db_session, repo.repo_id, "v1.0.0")

        for i in range(50):
            await musehub_releases.attach_asset(
                db_session,
                release_id=r.release_id,
                repo_id=repo.repo_id,
                name=f"asset-{i}.zip",
                download_url=f"https://cdn.example.com/asset-{i}.zip",
            )

        start = time.monotonic()
        assets = await musehub_releases.list_release_assets(db_session, r.release_id, "v1.0.0")
        elapsed = time.monotonic() - start

        assert len(assets.assets) == 50
        assert elapsed < 0.2, f"list_release_assets took {elapsed:.3f}s (limit 0.2s)"

    def test_parse_changelog_1000x_under_100ms(self) -> None:
        raw = '[{"commit_id":"abc","message":"feat: x","sem_ver_bump":"minor","breaking_changes":[],"author":"alice","timestamp":"2025-01-01"}]'
        start = time.monotonic()
        for _ in range(1000):
            _parse_changelog(raw)
        elapsed = time.monotonic() - start
        assert elapsed < 0.1, f"1000× _parse_changelog took {elapsed:.3f}s (limit 0.1s)"

    def test_parse_semantic_report_100x_under_50ms(self) -> None:
        report = SemanticReleaseReportResponse(total_files=10, total_symbols=50)
        raw = report.model_dump_json()
        start = time.monotonic()
        for _ in range(100):
            _parse_semantic_report(raw)
        elapsed = time.monotonic() - start
        assert elapsed < 0.05, f"100× _parse_semantic_report took {elapsed:.3f}s (limit 0.05s)"