import importlib.util
from pathlib import Path
import unittest

spec = importlib.util.spec_from_file_location('probe_renderer', Path(__file__).with_name('render-upstream-issuer-probe.py'))
renderer = importlib.util.module_from_spec(spec)
spec.loader.exec_module(renderer)
IMAGE = 'forgejo.coulomb.social/coulomb/key-cape@sha256:' + 'a' * 64
STATE = 'A' * 43
UID = '12345678-1234-1234-1234-123456789abc'


class RenderProbeTests(unittest.TestCase):
    def test_dedicated_route_and_pod_cannot_join_production_service(self):
        packet = renderer.render(IMAGE, STATE, UID)
        job = packet['job']
        pod = job['spec']['template']
        self.assertNotIn('app.kubernetes.io/name', pod['metadata']['labels'])
        self.assertFalse(pod['spec']['automountServiceAccountToken'])
        self.assertEqual(job['spec']['activeDeadlineSeconds'], 600)
        self.assertEqual(job['spec']['backoffLimit'], 0)
        self.assertEqual(job['spec']['ttlSecondsAfterFinished'], 300)
        children = packet['children']['items']
        self.assertEqual(len(children), 4)
        for child in children:
            self.assertEqual(child['metadata']['ownerReferences'][0]['uid'], UID)
        route = children[1]['spec']['routes'][0]
        self.assertIn('Query(`state`, `' + STATE + '`)', route['match'])
        self.assertIn('Path(`/authorize/callback`)', route['match'])
        self.assertNotIn('PathPrefix', route['match'])
        self.assertFalse(route['observability']['accessLogs'])
        self.assertFalse(route['observability']['tracing'])

    def test_only_config_yaml_is_projected_without_signing_key_or_api_token(self):
        pod = renderer.render(IMAGE, STATE)['job']['spec']['template']['spec']
        self.assertEqual(len(pod['volumes']), 1)
        secret = pod['volumes'][0]['secret']
        self.assertEqual(secret['secretName'], 'keycape-config')
        self.assertEqual(secret['items'], [{'key': 'config.yaml', 'path': 'config.yaml', 'mode': 0o440}])
        security = pod['containers'][0]['securityContext']
        self.assertTrue(security['readOnlyRootFilesystem'])
        self.assertFalse(security['allowPrivilegeEscalation'])

    def test_no_route_or_scope_injection_and_no_mutable_image(self):
        for state in ['', STATE + '`)', 'B' * 43, 'A' * 22]:
            with self.assertRaises(ValueError):
                renderer.render(IMAGE, state)
        with self.assertRaises(ValueError):
            renderer.render('forgejo.coulomb.social/coulomb/key-cape:latest', STATE)
        with self.assertRaises(ValueError):
            renderer.render(IMAGE, STATE, 'arbitrary-owner')


if __name__ == '__main__':
    unittest.main()

class ReceiptTests(unittest.TestCase):
    def setUp(self):
        import json
        self.json = json
        spec = importlib.util.spec_from_file_location('collector', Path(__file__).with_name('collect-upstream-issuer-proof.py'))
        self.collector = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(self.collector)
        self.receipt = {'schema': 'keycape.upstream-issuer-proof.v1', 'status': 'verified',
                        'observed_at': '2026-09-08T22:00:00Z', 'issuer': 'https://auth.coulomb.social',
                        'tokens_retained': False, 'downstream_credential_issued': False,
                        'signature_verified': True, 'audience_verified': True,
                        'validity_window_verified': True, 'nonce_verified': True}

    def test_verified_receipt_is_preserved(self):
        self.assertEqual(self.collector.sanitize(self.json.dumps(self.receipt)), self.receipt)

    def test_extra_claims_unverified_issuers_and_untyped_success_are_refused(self):
        for patch in [{'sub': 'private-user'}, {'issuer': 'https://unreviewed.example'},
                      {'signature_verified': 1}, {'tokens_retained': True}]:
            with self.assertRaises(ValueError):
                self.collector.sanitize(self.json.dumps(dict(self.receipt, **patch)))
        with self.assertRaises(ValueError):
            self.collector.sanitize(self.json.dumps(self.receipt) + '\nprivate-token')