from pathlib import Path


ROOT = Path(__file__).parents[1]


def test_whitehat_ingress_is_bound_to_namespace_and_target_labels():
    documents = (ROOT / "deploy" / "networkpolicies.yaml").read_text().split("\n---\n")
    policy = next(
        document
        for document in documents
        if "name: audit-core-whitehat-ingress" in document
    )

    # Both selectors must remain in the same `from` peer. Splitting them into
    # two list items changes AND to OR and would admit every pod in either set.
    expected_peer = """        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: whitehat
          podSelector:
            matchLabels:
              whitehat.security/plane: \"true\"
              whitehat.security/target: audit-core"""
    assert expected_peer in policy
    assert policy.count("        - namespaceSelector:") == 1
    assert "        - {protocol: TCP, port: 8080}" in policy