"""Scope checks for the credential-free browser UI probe; no GUI launch."""

import base64
import sys
import unittest
from pathlib import Path
from types import SimpleNamespace

sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "tools"))
import vergabe_operator_browser_probe as probe


class ProbeBoundaryTests(unittest.TestCase):
    def test_windows_probe_accepts_only_fixed_loopback_test_page(self):
        for url in ("https://auth.coulomb.social/", "http://127.0.0.1:1234/?code=synthetic",
                    "http://127.0.0.1:1234/oidc/callback", "http://user:password@127.0.0.1:1234/",
                    "http://127.0.0.1:1234/#fragment", "http://127.0.0.1:0/"):
            with self.subTest(url=url), self.assertRaises(ValueError):
                probe.windows_argv(url, 120)

    def test_native_command_uses_private_disposable_profile_and_owned_process_cleanup(self):
        argv = probe.windows_argv("http://127.0.0.1:1234/", 120)
        self.assertEqual(argv[:4], [probe.POWERSHELL, "-NoProfile", "-NonInteractive", "-EncodedCommand"])
        script = base64.b64decode(argv[4]).decode("utf-16le")
        self.assertIn("'/inheritance:r'", script)
        self.assertIn("$grant='*'+$sid.Value+':(OI)(CI)F'", script)
        self.assertIn("WindowsIdentity]::GetCurrent().User", script)
        self.assertIn("--user-data-dir=", script)
        self.assertIn("$current.StartTime.ToUniversalTime().Ticks -eq $startTicks", script)
        self.assertIn("$current.Path -eq $browser", script)
        self.assertNotIn("Stop-Process -Name", script)
        for flag in ("--no-sandbox", "--disable-web-security", "--ignore-certificate-errors", "--remote-debugging"):
            self.assertNotIn(flag, script)
        self.assertNotIn("auth.coulomb.social", script)
        self.assertNotIn("kc.coulomb.social", script)

    def test_software_comparison_keeps_real_launcher_profile_and_url(self):
        module = SimpleNamespace(launch_argv=lambda browser, profile, url: [browser, "--user-data-dir=" + profile,
                                                                         "--no-first-run", url])
        argv = probe.probe_argv(module, "/cache/chrome", Path("/tmp/empty-probe"), "http://127.0.0.1:1234/", True)
        self.assertIn("--user-data-dir=/tmp/empty-probe", argv)
        self.assertEqual(argv[-1], "http://127.0.0.1:1234/")
        self.assertIn("--ozone-platform=x11", argv)
        self.assertIn("--disable-gpu", argv)
        self.assertNotIn("--no-sandbox", argv)


if __name__ == "__main__":
    unittest.main()