"""The retained OpenBao package copy must not be applied from this repo.

rapp-openbao owns the package. Two deployable copies drifted apart, and a
deploy of one undid the other's changes (RPF-WP-0057). The write targets here
refuse before running kubectl or helm.
"""
import os
import pathlib
import subprocess

import pytest

ROOT = pathlib.Path(__file__).resolve().parents[1]


@pytest.mark.parametrize("target", ["openbao-overlay-apply", "openbao-deploy"])
def test_write_target_refuses_without_touching_cluster(target, tmp_path):
    marker = tmp_path / "called"
    fake = tmp_path / "fake"
    fake.write_text(f"#!/bin/sh\ntouch {marker}\n")
    fake.chmod(0o755)
    env = dict(os.environ, KUBECTL_BIN=str(fake), HELM=str(fake), KUBECONFIG=str(tmp_path / "none"))
    result = subprocess.run(["make", "-s", target], cwd=ROOT, env=env, capture_output=True, text=True)
    assert result.returncode != 0
    assert "owned by rapp-openbao" in result.stderr
    assert f"cd ~/rapp-openbao && make {target}" in result.stderr
    assert not marker.exists()


def test_dry_run_and_prerequisites_do_not_reach_the_write_path():
    text = (ROOT / "Makefile").read_text()
    for target in ("openbao-overlay-apply", "openbao-deploy"):
        line = next(l for l in text.splitlines() if l.startswith(target + ":"))
        assert line.split(":", 1)[1].split("##")[0].strip() == "", line