"""Actual package closure and fixed protected-path ABI; no privileged effects."""
import ast
import importlib.util
import pathlib
import tarfile
import tempfile
import unittest
from unittest.mock import patch

ROOT = pathlib.Path(__file__).resolve().parents[2]
spec = importlib.util.spec_from_file_location('custody_owner_package', ROOT / 'scripts/package-d09-c01.py')
packager = importlib.util.module_from_spec(spec)
spec.loader.exec_module(packager)


class PackageCustody(unittest.TestCase):
    def test_actual_archive_contains_complete_local_python_import_closure(self):
        with tempfile.TemporaryDirectory() as directory:
            target = pathlib.Path(directory) / 'owner.tar'
            packager.package(target)
            with tarfile.open(target) as archive:
                packaged = {pathlib.PurePosixPath(m.name).name for m in archive.getmembers()
                            if m.name.startswith('usr/libexec/')}
                self.assertIn('c01_uplink.py', packaged)
                self.assertIn('os_update_custody.py', packaged)
                import os_update_owner
                self.assertTrue(set(os_update_owner.MODULES) <= packaged)
                missing = []
                for name in packaged:
                    source = ROOT / 'scripts' / name
                    if not source.is_file() or source.suffix != '.py':
                        continue
                    for node in ast.walk(ast.parse(source.read_bytes())):
                        imports = ([node.module] if isinstance(node, ast.ImportFrom) and node.level == 0 else
                                   [a.name for a in node.names] if isinstance(node, ast.Import) else [])
                        for imported in imports:
                            if imported:
                                local = imported.split('.')[0] + '.py'
                                if (ROOT / 'scripts' / local).is_file() and local not in packaged:
                                    missing.append((name, local))
                self.assertEqual(missing, [])

    def test_executor_and_postboot_policy_use_independent_sibling(self):
        import os_update_executor as executor
        import os_updater_activate as activate
        self.assertEqual(str(executor.ROOT), '/var/lib/archipelago-os-update')
        # This source-only check reads the user checkout, not an admitted package.
        with patch.object(activate.bootstrap, 'read', side_effect=lambda p: p.read_bytes()):
            self.assertEqual(activate.declared_root(ROOT), executor.ROOT)
        self.assertEqual(activate.OWNER_POLICY, activate.owner_policy(executor.ROOT))
        with self.assertRaises(ValueError):
            activate.owner_policy(pathlib.Path('/var/lib/archipelago/os-update'))
        paths = activate.OWNER_POLICY.decode().split('ReadWritePaths=')[1].split()
        self.assertEqual(paths, ['/var/lib/dpkg/lock-frontend', '/var/lib/dpkg/lock',
            '/var/lib/archipelago-os-update/transactions', '/var/lib/archipelago-os-update/executor.lock'])


if __name__ == '__main__':
    unittest.main()