from __future__ import annotations

import os
import stat
import unittest

from .fixtures import isolated_environment


class FixtureTests(unittest.TestCase):
    def test_fixture_uses_private_directories_and_separate_sessions(self) -> None:
        inherited = os.environ.copy()
        inherited.update(
            {
                "OPENAI_API_KEY": "must-not-cross-boundary",
                "GITHUB_TOKEN": "must-not-cross-boundary",
                "SSH_AUTH_SOCK": "/tmp/host-agent.sock",
                "CUSTOM_SECRET_VALUE": "must-not-cross-boundary",
            }
        )
        with isolated_environment() as fixture:
            # The fixture intentionally does not accept an inherited environment;
            # this test still checks that the resulting allowlist is safe.
            self.assertNotIn("OPENAI_API_KEY", fixture.env)
            self.assertNotIn("GITHUB_TOKEN", fixture.env)
            self.assertNotIn("SSH_AUTH_SOCK", fixture.env)
            self.assertNotIn("CUSTOM_SECRET_VALUE", fixture.env)
            session_environment = fixture.session("one").environment(inherited)
            self.assertNotIn("OPENAI_API_KEY", session_environment)
            self.assertNotIn("GITHUB_TOKEN", session_environment)
            self.assertNotIn("SSH_AUTH_SOCK", session_environment)
            self.assertNotIn("CUSTOM_SECRET_VALUE", session_environment)
            self.assertEqual(
                set(fixture.env),
                {
                    "HOME",
                    "XDG_CONFIG_HOME",
                    "XDG_STATE_HOME",
                    "XDG_CACHE_HOME",
                    "XDG_RUNTIME_DIR",
                    "TMPDIR",
                    "PATH",
                    "LANG",
                    "LC_ALL",
                    "PYTHONDONTWRITEBYTECODE",
                },
            )
            for path in (
                fixture.root,
                fixture.home,
                fixture.xdg_config_home,
                fixture.xdg_state_home,
                fixture.xdg_cache_home,
                fixture.xdg_runtime_dir,
                fixture.tmpdir,
                fixture.repos,
                fixture.sessions,
                fixture.stub_bin,
            ):
                assert path is not None
                self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o700, path)
            first = fixture.session("one")
            second = fixture.session("two")
            self.assertNotEqual(first.tmp, second.tmp)
            self.assertNotEqual(first.state, second.state)
            self.assertEqual(stat.S_IMODE(first.tmp.stat().st_mode), 0o700)
            self.assertEqual(stat.S_IMODE(second.state.stat().st_mode), 0o700)

    def test_session_environment_points_only_at_its_paths(self) -> None:
        with isolated_environment() as fixture:
            session = fixture.session("one")
            environment = session.environment(fixture.env)
            self.assertEqual(environment["HOME"], str(session.home))
            self.assertEqual(environment["XDG_STATE_HOME"], str(session.state))
            self.assertEqual(environment["XDG_RUNTIME_DIR"], str(session.runtime))
            self.assertEqual(environment["TMPDIR"], str(session.tmp))
            self.assertNotIn("GH_TOKEN", environment)


if __name__ == "__main__":
    unittest.main()