"""Row E7: the executor's lldap_set_password comes from the LLDAP image the sso server runs (NK-WP-0058-T02).

The executor image copies /app/lldap_set_password from a digest-pinned LLDAP image (bounded-executor/Containerfile).
The tool speaks LLDAP's OPAQUE protocol, so it must be the server's own version: the two digests must be equal.
"""
import re
from pathlib import Path

import yaml

REPO = Path(__file__).resolve().parents[3]
DIGEST = r'docker\.io/lldap/lldap@(sha256:[0-9a-f]{64})'


def test_executor_tool_matches_the_lldap_server():
    tool = re.findall(DIGEST, (REPO / 'bounded-executor/Containerfile').read_text())
    deployment = next(d for d in yaml.safe_load_all((REPO / 'sso-mfa/k8s/lldap/deployment.yaml').read_text())
                      if d and d.get('kind') == 'Deployment')
    server = [m for c in deployment['spec']['template']['spec']['containers'] for m in re.findall(DIGEST, c['image'])]
    assert len(tool) == 1 and len(server) == 1, (tool, server)
    assert tool == server, 'the executor image would copy lldap_set_password from another LLDAP version'