"""Guard the release security gate's exact RC metadata and runbook URL rules."""

from __future__ import annotations

import runpy
from pathlib import Path

import pytest

GATE = runpy.run_path(str(Path(__file__).resolve().parents[2] / "scripts" / "security_gate.py"))


def test_first_party_rc_wheel_version_matches_only_the_same_release() -> None:
    matches = GATE["_matches_first_party_version"]

    assert matches("1.3.0-rc.1", "1.3.0-rc.1")
    assert matches("1.3.0rc1", "1.3.0-rc.1")
    assert not matches("1.3.0rc2", "1.3.0-rc.1")
    assert not matches("1.3.1rc1", "1.3.0-rc.1")
    assert not matches(None, "1.3.0-rc.1")


def test_web_bundle_allows_only_repository_runbook_context() -> None:
    validate = GATE["_validate_non_api_origin_contexts"]
    input_bytes = (
        b"https://git.example.com/example/modelforge/"
        b"src/branch/master/docs/operations/RUNBOOK_NODE_OFFLINE.md"
    )

    validate(input_bytes)
    with pytest.raises(GATE["GateInputError"]):
        validate(b"https://git.example.com/api/v1/tokens")