import importlib.util
import json
import tempfile
import unittest
from pathlib import Path
from unittest.mock import patch

ROOT=Path(__file__).resolve().parents[1]
def load(name, filename):
    spec=importlib.util.spec_from_file_location(name, ROOT/'scripts'/filename)
    module=importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
    return module
reader=load('reader','approval-client-reader-preflight.py')
delivery=load('delivery','approval-client-delivery-check.py')

class ReaderBoundary(unittest.TestCase):
    def test_additive_identity_admin_policy_is_refused(self):
        base={'policies':[reader.POLICY,'default'],'entity_id':'fixture','ttl':899}
        reader.validate_identity(base)
        for change in ({'identity_policies':['platform-admin']},{'policies':['default']},{'ttl':901},{'entity_id':''}):
            with self.subTest(change=change), self.assertRaises(ValueError):
                reader.validate_identity(base|change)

    def test_refused_preflight_never_fetches_credentials(self):
        with tempfile.TemporaryDirectory() as directory:
            receipt=Path(directory)/'receipt.json'
            with patch.object(delivery,'RECEIPT',receipt), patch.object(delivery.preflight,'main',side_effect=ValueError('fixture refusal')), patch.object(delivery,'transport') as transport:
                with self.assertRaises(ValueError): delivery.main()
                transport.assert_not_called()
            recorded=json.loads(receipt.read_text())
            self.assertEqual(recorded['status'],'refused')
            self.assertTrue(recorded['cleanup'])
            self.assertNotIn('fixture refusal',receipt.read_text())

    def test_private_file_refuses_symlink_and_group_read(self):
        with tempfile.TemporaryDirectory() as directory:
            path=Path(directory)/'secret'; path.write_text('synthetic'); path.chmod(0o600)
            delivery.private(path,0o600)
            link=Path(directory)/'link'; link.symlink_to(path)
            with self.assertRaises(ValueError): delivery.private(link,0o600)
            path.chmod(0o640)
            with self.assertRaises(ValueError): delivery.private(path,0o600)

    def test_credential_redirect_is_refused(self):
        self.assertIsNone(delivery.NoRedirect().redirect_request(None,None,302,'redirect',{},'https://unrelated.invalid'))

if __name__=='__main__': unittest.main()