#!/usr/bin/env python3
"""Source render integration tests; never contacts the cluster."""
import copy
import importlib.util
from pathlib import Path
import subprocess
import unittest
import yaml

ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location("twins", ROOT / "tools/gen_runtime_twins.py")
twins = importlib.util.module_from_spec(spec)
spec.loader.exec_module(twins)

def render(chart, values, namespace, name):
    output = subprocess.check_output(["helm", "template", name, str(ROOT / "charts" / chart), "-f", str(ROOT / "values" / values), "--namespace", namespace], text=True)
    return {obj["kind"]: obj for obj in yaml.safe_load_all(output) if obj}

def after(args, flag):
    return [args[i + 1] for i, item in enumerate(args[:-1]) if item == flag]

class RuntimeTwinTests(unittest.TestCase):
    def test_actual_nine_twin_render_security_and_content(self):
        for pin in twins.PINS:
            with self.subTest(pin=pin):
                source = yaml.safe_load((ROOT / "values" / (pin + ".yaml")).read_text())
                new = yaml.safe_load((ROOT / "values/access-engine" / (pin + ".yaml")).read_text())
                self.assertEqual(new, twins.twin(source))
                old_objects = render("flex-auth", pin + ".yaml", "flex-auth", source["name"])
                objects = render("access-engine", "access-engine/" + pin + ".yaml", "access-engine", new["name"])
                self.assertEqual(set(objects), set(old_objects))
                for kind in ("Deployment", "Service", "ServiceAccount", "NetworkPolicy"):
                    self.assertEqual(objects[kind]["metadata"]["namespace"], "access-engine")
                deployment = objects["Deployment"]
                pod = deployment["spec"]["template"]["spec"]
                container = pod["containers"][0]
                old_container = old_objects["Deployment"]["spec"]["template"]["spec"]["containers"][0]
                self.assertEqual(container["image"], old_container["image"])
                self.assertEqual(container["args"][:len(source["args"])], source["args"])
                self.assertEqual(after(container["args"], "--caller-audience"), ["access-engine"])
                self.assertEqual(after(container["args"], "--caller-binding"), after(old_container["args"], "--caller-binding"))
                self.assertEqual(after(container["args"], "--readback-caller"), after(old_container["args"], "--readback-caller"))
                self.assertEqual(pod["serviceAccountName"], new["name"])
                mount = next(m["mountPath"] for m in container["volumeMounts"] if m["name"] == "access-engine-reviewer")
                self.assertEqual(after(container["args"], "--caller-reviewer-token-file"), [mount + "/token"])
                self.assertEqual(after(container["args"], "--caller-ca-file"), [mount + "/ca.crt"])
                self.assertFalse(pod["automountServiceAccountToken"])
                self.assertEqual(objects["ClusterRole"]["rules"], old_objects["ClusterRole"]["rules"])
                binding = objects["ClusterRoleBinding"]
                self.assertEqual(binding["subjects"], [{"kind": "ServiceAccount", "name": new["name"], "namespace": "access-engine"}])
                self.assertEqual(binding["roleRef"]["name"], new["name"] + "-tokenreviewer")
                self.assertEqual(objects["NetworkPolicy"]["spec"]["ingress"], old_objects["NetworkPolicy"]["spec"]["ingress"])
                self.assertEqual(objects["NetworkPolicy"]["spec"]["egress"], old_objects["NetworkPolicy"]["spec"]["egress"])
                self.assertEqual(objects["Service"]["spec"]["selector"], deployment["spec"]["selector"]["matchLabels"])
                self.assertEqual(deployment["spec"]["selector"]["matchLabels"], {"app.kubernetes.io/name": new["name"]})
                self.assertTrue(container["securityContext"]["readOnlyRootFilesystem"])
                self.assertFalse(container["securityContext"]["allowPrivilegeEscalation"])
                self.assertEqual(container["livenessProbe"], old_container["livenessProbe"])
                self.assertEqual(container["readinessProbe"], old_container["readinessProbe"])

    def test_refuse_unpinned_unenforced_and_shared_writer(self):
        source = yaml.safe_load((ROOT / "values/user-engine.yaml").read_text())
        for field, value in (("image", {"digest": "latest"}), ("callerAuth", {"mode": "disabled"}), ("outbox", {"enabled": True}), ("auditDelivery", {"enabled": True}), ("name", "other-pin")):
            with self.subTest(field=field):
                bad = copy.deepcopy(source); bad[field] = value
                with self.assertRaises(ValueError): twins.twin(bad)
        self.assertNotIn("namespace", source)

if __name__ == "__main__": unittest.main()