from __future__ import annotations

import copy
import json
import subprocess
import sys
import unittest
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "scripts"))

from baseline_contract import (  # noqa: E402
    BaselineError,
    load_spec,
    profile_hostvars,
    validate_repo_consumers,
    validate_spec,
)


class BaselineContractTests(unittest.TestCase):
    def setUp(self) -> None:
        self.payload = load_spec(ROOT / "spec" / "server-baseline.yaml")

    def test_profiles_resolve_distinct_firewall_controls(self) -> None:
        managed = profile_hostvars(self.payload, "ufw-managed")
        external = profile_hostvars(self.payload, "external-firewall")
        self.assertTrue(managed["ufw_manage"])
        self.assertIn("ufw", managed["baseline_required_services"])
        self.assertFalse(external["ufw_manage"])
        self.assertNotIn("ufw", external["baseline_required_services"])
        self.assertIn("replacement_control", external["baseline_firewall"])

    def test_governed_package_mismatch_fails(self) -> None:
        broken = copy.deepcopy(self.payload)
        broken["defaults"]["packages"].remove("htop")
        with self.assertRaisesRegex(BaselineError, "htop"):
            validate_spec(broken)

    def test_governed_ssh_weakening_fails(self) -> None:
        broken = copy.deepcopy(self.payload)
        broken["defaults"]["ssh_directives"]["PermitRootLogin"] = "yes"
        with self.assertRaisesRegex(BaselineError, "SSH"):
            validate_spec(broken)

    def test_ansible_and_goss_consume_shared_variables(self) -> None:
        validate_repo_consumers(ROOT)

    def test_dynamic_inventory_resolves_each_host_profile(self) -> None:
        raw = subprocess.check_output(
            [sys.executable, str(ROOT / "ansible" / "inventory_from_yaml.py")],
            text=True,
            cwd=ROOT,
        )
        hostvars = json.loads(raw)["_meta"]["hostvars"]
        self.assertEqual("external-firewall", hostvars["CoulombCore"]["baseline_profile"])
        self.assertEqual("ufw-managed", hostvars["Railiance01"]["baseline_profile"])


if __name__ == "__main__":
    unittest.main()