from pathlib import Path


ROOT = Path(__file__).parents[1]


def test_whitehat_ingress_is_bound_to_namespace_and_target_labels():
    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
    policy = next(
        document
        for document in documents
        if "name: audit-core-whitehat-ingress" in document
    )

    # Both selectors must remain in the same `from` peer. Splitting them into
    # two list items changes AND to OR and would admit every pod in either set.
    expected_peer = """        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: whitehat
          podSelector:
            matchLabels:
              whitehat.security/plane: \"true\"
              whitehat.security/target: audit-core"""
    assert expected_peer in policy
    assert policy.count("        - namespaceSelector:") == 1
    assert "        - {protocol: TCP, port: 8080}" in policy


def test_approval_engine_ingress_is_bound_to_namespace_and_pod_labels():
    """AUDIT-WP-0009-T09. A load-bearing source gets a narrow rule, not a wide one."""
    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
    policy = next(
        document
        for document in documents
        if "name: audit-core-approval-engine-ingress" in document
    )

    # One `from` peer holding both selectors. Two list items would be OR, and
    # would admit every pod in the approval-engine namespace plus every pod
    # anywhere carrying the app label.
    expected_peer = """        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: approval-engine
          podSelector:
            matchLabels:
              app.kubernetes.io/name: approval-engine"""
    assert expected_peer in policy
    assert policy.count("        - namespaceSelector:") == 1
    assert "        - {protocol: TCP, port: 8080}" in policy


def test_user_engine_sender_ingress_is_unchanged_by_the_new_sender():
    """glas-harness asked for user-engine's sender to stay as it is."""
    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
    policy = next(
        document
        for document in documents
        if "name: audit-core-sender-ingress" in document
    )
    assert "kubernetes.io/metadata.name: user-engine" in policy
    assert "approval-engine" not in policy