import hashlib
import unittest
from unit_transform import transform


def sha(value):return hashlib.sha256(value).hexdigest()


class TransformTests(unittest.TestCase):
    def test_exact_flag_preserves_every_other_byte(self):
        raw=b'[Service]\nExecStart=/usr/local/bin/k3s server --write-kubeconfig-mode=644 --other=kept\n'
        expected=raw.replace(b'mode=644',b'mode=600')
        self.assertEqual(transform(raw,before=sha(raw),after=sha(expected)),expected)

    def test_changed_preimage_refuses(self):
        with self.assertRaisesRegex(ValueError,'preimage'):transform(b'unknown')

    def test_multiple_flags_refuse(self):
        raw=b'--write-kubeconfig-mode=644 --write-kubeconfig-mode=644'
        with self.assertRaisesRegex(ValueError,'not_exact'):transform(raw,before=sha(raw),after=sha(raw))

    def test_missing_flag_refuses(self):
        raw=b'--write-kubeconfig-mode=600'
        with self.assertRaisesRegex(ValueError,'not_exact'):transform(raw,before=sha(raw),after=sha(raw))

    def test_wrong_candidate_refuses(self):
        raw=b'--write-kubeconfig-mode=644'
        with self.assertRaisesRegex(ValueError,'candidate_mismatch'):transform(raw,before=sha(raw),after=sha(raw))


if __name__=='__main__':unittest.main()