import shutil
import subprocess
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[1]
SCRIPT = ROOT / "infrastructure/images/security-bases/ingestion-clamd/verify-pcre2.sh"


@pytest.mark.parametrize(
    ("inventory", "accepted"),
    [
        ("P:unrelated\nV:1.0\n\nP:pcre2\nV:10.49-r0\nT:normal description\n", True),
        ("P:pcre2\nV:10.48-r0\n", False),
        ("P:pcre2\n", False),
        ("P:pcre2\nV:10.49-r0\nV:10.49-r0\n", False),
        ("P:pcre2\nV:10.49-r0\n\nP:pcre2\nV:10.49-r0\n", False),
        ("P:pcre2\nP:pcre2\nV:10.49-r0\n", False),
        ("P:unrelated\nV:10.49-r0\n", False),
        ("P:pcre2\nV:private-secret-never-echo\n", False),
        (
            "pcre2-10.49-r0 description:\nPerl-compatible regular expressions library\n"
            "pcre2-10.49-r0 webpage:\nhttps://www.pcre.org/\n"
            "pcre2-10.49-r0 installed size:\n1234 B\n",
            False,
        ),
    ],
)
def test_actual_inventory_query_rejects_ambiguous_or_verbose_apk_output(
    inventory: str, accepted: bool
) -> None:
    source = SCRIPT.read_text()
    assert "apk info" not in source
    query = source.split("awk -v RS='' '", 1)[1].split("\n' /lib/apk/db/installed", 1)[0]
    binary = shutil.which("awk")
    fallback = Path("C:/Program Files/Git/usr/bin/awk.exe")
    if binary is None and fallback.is_file():
        binary = str(fallback)
    if binary is None:
        pytest.skip("real awk query runs in required native Linux CI")
    result = subprocess.run(  # noqa: S603 - exact trusted installed-inventory query
        [binary, "-v", "RS=", query], input=inventory, text=True, capture_output=True, timeout=10
    )
    assert (result.returncode == 0) is accepted
    assert result.stdout == ("10.49-r0\n" if accepted else "")
    assert "private-secret" not in result.stdout + result.stderr