import tempfile
import unittest
from pathlib import Path

import sys

sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "runtime"))
from zhulan_code_gate import scan_file, within  # noqa: E402


class CodeGateTest(unittest.TestCase):
    def test_paths_fail_closed(self):
        self.assertTrue(within("server-tools/zhulan-remote-cell/ui/app.js", ["server-tools/zhulan-remote-cell"]))
        self.assertFalse(within("server-tools/lake-lamp-authz/server.js", ["server-tools/zhulan-remote-cell"]))

    def test_private_key_is_rejected(self):
        with tempfile.TemporaryDirectory() as root:
            workspace = Path(root)
            target = workspace / "leak.txt"
            target.write_text("-----BEGIN OPENSSH PRIVATE KEY-----\nnot-real\n", encoding="utf-8")
            self.assertIn("possible_secret", scan_file(workspace, target, 1024 * 1024))

    def test_symlink_outside_workspace_is_rejected(self):
        with tempfile.TemporaryDirectory() as root, tempfile.TemporaryDirectory() as outside:
            workspace = Path(root)
            target = workspace / "outside-link"
            target.symlink_to(Path(outside) / "secret")
            self.assertIn("symlink_outside_workspace", scan_file(workspace, target, 1024 * 1024))


if __name__ == "__main__":
    unittest.main()