import importlib.util
import shutil
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location("bundle_verifier", ROOT / "scripts/verify_custodian_bundle.py")
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)


def test_reviewed_bundle_bytes():
    result = module.verify(ROOT / "k8s/custodian-release/commands", "60d893af1bf77f457504b64ff1c9ffb5c6ae6579")
    assert result["verified_files"] == 4


def test_tampered_installed_file_refused(tmp_path):
    shutil.copytree(ROOT / "k8s/custodian-release/commands", tmp_path / "bundle")
    (tmp_path / "bundle/scripts/security_flow_daily.py").write_text("changed")
    with pytest.raises(ValueError, match="hash mismatch"):
        module.verify(tmp_path / "bundle")


def test_installed_symlink_refused(tmp_path):
    shutil.copytree(ROOT / "k8s/custodian-release/commands", tmp_path / "bundle")
    path = tmp_path / "bundle/scripts/security_flow_daily.py"
    path.unlink()
    path.symlink_to(ROOT / "k8s/custodian-release/commands/scripts/security_flow_daily.py")
    with pytest.raises(ValueError, match="regular installed"):
        module.verify(tmp_path / "bundle")