from __future__ import annotations

import os
import tempfile
import unittest
from pathlib import Path

from scripts.verify_demo_token_runtime import validate_mount


class DemoTokenRuntimeCheckTests(unittest.TestCase):
    def test_accepts_exact_read_only_regular_file_mount(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            path = Path(directory) / "revocations.json"
            path.write_text('{"schemaVersion":"1.0","revokedJtis":[]}\n', encoding="utf-8")
            path.chmod(0o600)
            report = validate_mount(
                [{"Destination": "/etc/itworx", "Source": str(path.parent), "RW": False}], path
            )
        self.assertEqual(report["status"], "pass")
        if os.name != "nt":
            self.assertEqual(report["mode"], "0600")

    def test_rejects_wrong_or_writable_mount(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            expected = Path(directory) / "expected.json"
            actual = Path(directory) / "example.json"
            expected.write_text("{}", encoding="utf-8")
            actual.write_text("{}", encoding="utf-8")
            expected.chmod(0o600)
            actual.chmod(0o600)
            with self.assertRaisesRegex(ValueError, "does not match"):
                validate_mount(
                    [
                        {
                            "Destination": "/etc/itworx",
                            "Source": str(actual.parent / "wrong"),
                            "RW": False,
                        }
                    ],
                    expected,
                )
            with self.assertRaisesRegex(ValueError, "read-only"):
                validate_mount(
                    [{"Destination": "/etc/itworx", "Source": str(expected.parent), "RW": True}],
                    expected,
                )