import importlib.util
from pathlib import Path
import subprocess
import unittest

BASE = Path(__file__).parent
spec = importlib.util.spec_from_file_location('verify_guest', BASE/'verify-guest.py')
m = importlib.util.module_from_spec(spec); spec.loader.exec_module(m)


class RecipeTests(unittest.TestCase):
    def good(self):
        return dict(distro='custodian-codex',uid=1001,gid=1001,home_mode=0o700,
                    state_mode=0o700,home_uid=1001,state_uid=1001,groups=[1001],
                    interop='false',automount='false',mount_fstab='false',
                    windows_mount=False,operator_home=False,interop_handler=False)

    def test_partial_pass_is_never_admission(self):
        r=m.check_snapshot(self.good())
        self.assertTrue(r['partial_preflight_passed']); self.assertFalse(r['assignment_admitted'])

    def test_each_missing_boundary_blocks(self):
        for key,bad in dict(distro='Ubuntu-24.04',uid=1000,gid=0,home_mode=0o755,
                            state_mode=0o755,home_uid=0,state_uid=0,groups=[1001,27],
                            interop='true',automount='true',mount_fstab='true',
                            windows_mount=True,operator_home=True,interop_handler=True).items():
            with self.subTest(key=key):
                s=self.good();s[key]=bad
                self.assertFalse(m.check_snapshot(s)['partial_preflight_passed'])

    def test_script_lock_refuses_without_privileges(self):
        r=subprocess.run(['bash',str(BASE/'guest-stage.sh')],capture_output=True,text=True)
        self.assertEqual(r.returncode,78);self.assertIn('execution disabled',r.stderr)

    def test_shell_syntax(self):
        subprocess.run(['bash','-n',str(BASE/'guest-stage.sh')],check=True)

    def test_import_remains_locked(self):
        lines=[x for x in (BASE/'import-disabled.ps1').read_text().splitlines() if x and not x.startswith('#')]
        self.assertTrue(lines[0].startswith("throw 'REFUSED:"))


if __name__ == '__main__':
    unittest.main()