"""The sso namespace admits the bounded executor exactly where its pilot steps go (NK-WP-0056). No cluster."""

import pathlib
import unittest

import yaml

NETPOL = pathlib.Path(__file__).resolve().parents[1] / "network-policies" / "netpol-sso.yaml"
EXECUTOR = {"app.kubernetes.io/name": "bounded-executor"}
EXPECTED = {("lldap", 17170), ("keycape", 8080), ("authelia", 9091)}


def policies():
    return [d for d in yaml.safe_load_all(NETPOL.read_text()) if d]


def executor_ingress():
    for pol in policies():
        for rule in pol["spec"].get("ingress", []):
            if any(peer.get("podSelector", {}).get("matchLabels") == EXECUTOR for peer in rule["from"]):
                yield pol, rule


class ExecutorIngress(unittest.TestCase):
    def test_exactly_the_pilot_paths(self):   # in particular never LDAP :3890
        found = set()
        for pol, rule in executor_ingress():
            target = pol["spec"]["podSelector"]["matchLabels"]["app.kubernetes.io/name"]
            found |= {(target, p["port"]) for p in rule["ports"]}
        self.assertEqual(found, EXPECTED)

    def test_peers_are_in_namespace_executor_pods_only(self):
        for pol, rule in executor_ingress():
            self.assertEqual(pol["metadata"]["namespace"], "sso")
            self.assertEqual(pol["spec"]["policyTypes"], ["Ingress"])
            for peer in rule["from"]:
                self.assertEqual(peer, {"podSelector": {"matchLabels": EXECUTOR}})

    def test_default_deny_is_kept(self):
        deny = [p for p in policies() if p["metadata"]["name"] == "default-deny-all"]
        self.assertEqual(deny[0]["spec"], {"podSelector": {}, "policyTypes": ["Ingress", "Egress"]})


if __name__ == "__main__":
    unittest.main()