import unittest
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]


class DeploymentContractTest(unittest.TestCase):
    def test_runtime_upgrade_restarts_service(self):
        installer = (ROOT / "deploy" / "install-runtime.sh").read_text(encoding="utf-8")
        self.assertIn("systemctl enable zhulan-remote-cell.service", installer)
        self.assertIn("systemctl restart zhulan-remote-cell.service", installer)
        self.assertIn("systemctl restart zhulan-validation-executor.service", installer)
        self.assertNotIn("systemctl enable --now zhulan-remote-cell.service", installer)

    def test_bwrap_exception_is_scoped_to_runtime_copy(self):
        env = (ROOT / "deploy" / "zhulan-remote-cell.env.example").read_text(encoding="utf-8")
        profile = (ROOT / "deploy" / "zhulan-bwrap.apparmor").read_text(encoding="utf-8")
        installer = (ROOT / "deploy" / "install-runtime.sh").read_text(encoding="utf-8")
        private_copy = "/opt/guanghu/zhulan-remote-cell/runtime/zhulan-bwrap"
        self.assertIn(f"ZHULAN_BWRAP={private_copy}", env)
        self.assertIn(f"profile zhulan-remote-cell-bwrap {private_copy}", profile)
        self.assertIn("  userns,", profile)
        self.assertIn('install -o root -g zhulan-runtime -m 0750 /usr/bin/bwrap', installer)
        self.assertNotIn("kernel.apparmor_restrict_unprivileged_userns=0", installer)
        self.assertNotIn("chmod 4755", installer)

    def test_only_executor_allows_bwrap_required_netlink_addition(self):
        service = (ROOT / "deploy" / "zhulan-remote-cell.service").read_text(encoding="utf-8")
        executor = (ROOT / "deploy" / "zhulan-validation-executor.service").read_text(encoding="utf-8")
        self.assertIn(
            "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
            service,
        )
        self.assertNotIn("AF_NETLINK", service)
        self.assertIn("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK", executor)
        self.assertIn("RestrictNamespaces=user mnt pid net ipc uts", service)

    def test_public_runtime_keeps_no_new_privileges_and_uses_local_executor(self):
        public_service = (ROOT / "deploy" / "zhulan-remote-cell.service").read_text(encoding="utf-8")
        executor_service = (ROOT / "deploy" / "zhulan-validation-executor.service").read_text(encoding="utf-8")
        runtime = (ROOT / "runtime" / "zhulan_cell.py").read_text(encoding="utf-8")
        self.assertIn("NoNewPrivileges=true", public_service)
        self.assertIn("ProtectKernelTunables=true", public_service)
        self.assertIn("Requires=zhulan-validation-executor.service", public_service)
        self.assertNotIn("NoNewPrivileges=true", executor_service)
        self.assertNotIn("ProtectKernelTunables=true", executor_service)
        self.assertIn("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK", executor_service)
        self.assertIn("ReadOnlyPaths=/srv/guanghu/zhulan-cell/workspaces", executor_service)
        self.assertIn("PrivateNetwork=true", executor_service)
        self.assertIn("InaccessiblePaths=/etc/guanghu/secrets", executor_service)
        self.assertIn("ReadOnlyPaths=/var/lib/guanghu/zhulan-remote-cell", executor_service)
        self.assertIn("InaccessiblePaths=/srv/guanghu/zhulan-cell/candidates", executor_service)
        self.assertIn("socket.AF_UNIX", runtime)
        self.assertNotIn('argv = [\n                    str(self.settings.bwrap_path)', runtime)


if __name__ == "__main__":
    unittest.main()