"""Pure-function tests for install.sh.j2 rendering and agent.py parsing."""
import subprocess
from pathlib import Path

from jinja2 import Environment, FileSystemLoader

from plugins.host_agent.routes import _agent_version, AGENT_SOURCE_PATH


TEMPLATE_DIR = Path(__file__).resolve().parents[3] / "plugins" / "host_agent" / "templates"


def _render(**overrides) -> str:
    env = Environment(loader=FileSystemLoader(str(TEMPLATE_DIR)))
    defaults = dict(
        url="https://r.example",
        token="tok-abc",
        agent_version="1.0.0",
        host_name="testhost",
        host_address="10.0.0.1",
    )
    defaults.update(overrides)
    return env.get_template("install.sh.j2").render(**defaults)


def test_render_contains_token_and_url():
    out = _render()
    assert "tok-abc" in out
    assert "https://r.example" in out
    assert "testhost" in out


UNIT_DIR = TEMPLATE_DIR.parent / "files"


def test_the_agent_unit_is_hardened_and_may_write_only_its_requests():
    unit = (UNIT_DIR / "steward-agent.service").read_text()
    for needle in (
        "User=steward-agent",
        "NoNewPrivileges=true",
        "ProtectSystem=strict",
        "ProtectHome=true",
        "PrivateTmp=true",
        "ReadOnlyPaths=/proc /sys",
    ):
        assert needle in unit, f"missing {needle}"
    writable = [ln for ln in unit.splitlines() if ln.startswith("ReadWritePaths=")]
    assert writable == ["ReadWritePaths=-/var/lib/steward-agent/requests"]


def test_the_script_installs_the_served_units_not_its_own_copy():
    out = _render()
    assert "[Service]" not in out                       # no inline unit left to drift
    assert 'UNITS="steward-agent.service steward-maint.service steward-maint.path"' in out
    assert '${FILES_URL}/$u' in out and '${FILES_URL}/maint.py' in out
    assert "systemctl enable --now steward-maint.path" in out
    assert "systemctl restart steward-agent.service" in out


def test_render_has_uninstall_branch():
    out = _render()
    assert "--uninstall" in out
    assert "systemctl disable --now steward-maint.path steward-agent.service" in out


def test_render_uses_agent_py_url():
    out = _render()
    assert "/plugins/host_agent/agent.py" in out


def test_rendered_script_passes_sh_n(tmp_path):
    out = _render()
    script = tmp_path / "install.sh"
    script.write_text(out)
    result = subprocess.run(
        ["sh", "-n", str(script)], capture_output=True, text=True
    )
    assert result.returncode == 0, f"sh -n failed: {result.stderr}"


def test_agent_version_parses_on_disk_agent():
    # Version-agnostic: the parsed value must match the agent module's constant,
    # so a future AGENT_VERSION bump doesn't require touching this test.
    from plugins.host_agent import agent
    assert AGENT_SOURCE_PATH.exists()
    v = _agent_version()
    assert v == agent.AGENT_VERSION