import hashlib
from pathlib import Path
import unittest

from pi_dictate_service.startup import EXPECTED_BASE_UNIT_SHA256


REPOSITORY_ROOT = Path(__file__).resolve().parents[3]
UNIT_DIR = REPOSITORY_ROOT / "systemd/user"


class SystemdUnitTests(unittest.TestCase):
    def test_startup_hash_matches_the_checked_in_service_unit(self) -> None:
        self.assertEqual(
            hashlib.sha256((UNIT_DIR / "pi-dictate.service").read_bytes()).hexdigest(),
            EXPECTED_BASE_UNIT_SHA256,
        )

    def test_socket_unit_owns_the_exact_private_runtime_path(self) -> None:
        socket_unit = (UNIT_DIR / "pi-dictate.socket").read_text(encoding="utf-8")
        self.assertIn("ListenStream=%t/pi-dictate.sock", socket_unit)
        self.assertIn("SocketMode=0600", socket_unit)
        self.assertIn("Accept=no", socket_unit)
        self.assertIn("RemoveOnStop=yes", socket_unit)

    def test_service_is_offline_hardened_and_uses_private_native_caches(self) -> None:
        service_unit = (UNIT_DIR / "pi-dictate.service").read_text(encoding="utf-8")
        for expected in (
            "PI_DICTATE_MODEL_PATH=%h/.local/share/pi-dictate/models/",
            "PI_DICTATE_TERMS_PATH=%h/.local/share/pi-dictate/config/coding-terms.txt",
            "PI_DICTATE_BOOST_ALPHA=1.0",
            "HF_HUB_OFFLINE=1",
            "TRANSFORMERS_OFFLINE=1",
            "TRITON_CACHE_DIR=/tmp/pi-dictate-triton",
            "NUMBA_CACHE_DIR=/tmp/pi-dictate-numba",
            "TimeoutStopSec=5s",
            "LimitCORE=0",
            "MemorySwapMax=0",
            "ProtectSystem=strict",
            "ProtectHome=tmpfs",
            "BindReadOnlyPaths=%h/.local/share/pi-dictate",
            "BindReadOnlyPaths=%h/.local/share/uv/python",
            "BindReadOnlyPaths=%h/.config/pi-dictate/config.json",
            "BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service",
            "BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.service.d",
            "BindReadOnlyPaths=%h/.config/systemd/user/pi-dictate.socket",
            "BindReadOnlyPaths=%t/pipewire-0",
            "RestrictAddressFamilies=AF_UNIX",
            "SystemCallFilter=~bind listen",
            "IPAddressDeny=any",
        ):
            self.assertIn(expected, service_unit)


if __name__ == "__main__":
    unittest.main()