import hashlib
import importlib.util
from pathlib import Path

import pytest

spec = importlib.util.spec_from_file_location(
    "runtime_builder", Path(__file__).parents[1] / "scripts/build-rein-runtime.py"
)
builder = importlib.util.module_from_spec(spec)
spec.loader.exec_module(builder)


def test_claude_copy_is_pinned_and_excludes_home(tmp_path):
    source = tmp_path / "native"
    source.write_bytes(b"\x7fELFtest artifact, never executed")
    (tmp_path / "credentials.json").write_text("must not enter artifact")
    output = tmp_path / "runtime"
    (output / "bin").mkdir(parents=True)
    digest = hashlib.sha256(source.read_bytes()).hexdigest()
    metadata = builder.install_claude(output, source, digest, "test-version")
    assert metadata["sha256"] == digest
    assert metadata["path"] == "/opt/sandboxer/runtime/bin/claude"
    assert list((output / "bin").iterdir()) == [output / "bin/claude"]
    assert (output / "bin/claude").read_bytes() == source.read_bytes()
    assert (output / "bin/claude").stat().st_mode & 0o777 == 0o755
    assert not (output / "credentials.json").exists()
    with pytest.raises(FileExistsError):
        builder.install_claude(output, source, digest, "test-version")


def test_changed_binary_and_host_wrapper_refuse(tmp_path):
    source = tmp_path / "binary"
    source.write_bytes(b"#!/usr/bin/env node\n")
    output = tmp_path / "runtime"
    (output / "bin").mkdir(parents=True)
    with pytest.raises(ValueError, match="digest mismatch"):
        builder.install_claude(output, source, "0" * 64, "test-version")
    digest = hashlib.sha256(source.read_bytes()).hexdigest()
    with pytest.raises(ValueError, match="native ELF"):
        builder.install_claude(output, source, digest, "test-version")
    link = tmp_path / "link"
    link.symlink_to(source)
    with pytest.raises(ValueError, match="symlink"):
        builder.install_claude(output, link, digest, "test-version")
    assert not (output / "bin/claude").exists()


def test_incomplete_claude_pin_refuses_before_build(tmp_path):
    with pytest.raises(ValueError, match="supplied together"):
        builder.build(tmp_path / "out", tmp_path, tmp_path, claude_binary=tmp_path / "claude")
    assert not (tmp_path / "out").exists()