"""Mechanical checks on deploy/networkpolicies.yaml.

The bounded-executor rule must stay pod-scoped. Splitting namespaceSelector
and podSelector into two `from` elements turns AND into OR and admits every
pod in sso (KeyCape, Authelia, LLDAP) or every bounded-executor pod in any
namespace. That is a one-character YAML change review can miss.
"""

from __future__ import annotations

from pathlib import Path

import pytest

yaml = pytest.importorskip("yaml")

POLICIES = Path(__file__).resolve().parents[1] / "deploy" / "networkpolicies.yaml"


def _policies() -> dict[str, dict]:
    docs = [d for d in yaml.safe_load_all(POLICIES.read_text(encoding="utf-8")) if d]
    return {d["metadata"]["name"]: d for d in docs}


def test_default_deny_remains():
    spec = _policies()["approval-engine-default-deny"]["spec"]
    assert spec["podSelector"] == {}
    assert set(spec["policyTypes"]) == {"Ingress", "Egress"}


def test_bounded_executor_ingress_is_pod_scoped_to_sso_on_8080():
    policy = _policies()["approval-engine-bounded-executor"]
    assert policy["metadata"]["namespace"] == "approval-engine"
    spec = policy["spec"]
    assert spec["podSelector"] == {"matchLabels": {"app.kubernetes.io/name": "approval-engine"}}
    assert spec["policyTypes"] == ["Ingress"]
    assert len(spec["ingress"]) == 1
    rule = spec["ingress"][0]
    assert rule["from"] == [
        {
            "namespaceSelector": {"matchLabels": {"kubernetes.io/metadata.name": "sso"}},
            "podSelector": {"matchLabels": {"app.kubernetes.io/name": "bounded-executor"}},
        }
    ]
    assert rule["ports"] == [{"protocol": "TCP", "port": 8080}]


def test_no_policy_admits_sso_namespace_wide():
    for name, policy in _policies().items():
        for rule in policy["spec"].get("ingress", []):
            for peer in rule.get("from", []):
                ns = peer.get("namespaceSelector", {}).get("matchLabels", {})
                if ns.get("kubernetes.io/metadata.name") == "sso":
                    assert "podSelector" in peer, f"{name} admits all of sso"


def test_existing_callers_policy_is_unchanged():
    rule = _policies()["approval-engine-callers"]["spec"]["ingress"]
    assert rule == [
        {
            "from": [
                {"namespaceSelector": {"matchLabels": {"kubernetes.io/metadata.name": "secrets-engine"}}},
                {"namespaceSelector": {"matchLabels": {"railiance.io/approval-engine-client": "true"}}},
            ],
            "ports": [{"protocol": "TCP", "port": 8080}],
        }
    ]