import importlib.util
from pathlib import Path
import subprocess
import sys
import tempfile
import unittest

SCRIPT = Path(__file__).resolve().parents[1] / "tailscale-security.py"
spec = importlib.util.spec_from_file_location("tailscale_security", SCRIPT)
security = importlib.util.module_from_spec(spec)
spec.loader.exec_module(security)


class TailscaleSecurity(unittest.TestCase):
    def test_security_boundary_and_numeric_order(self):
        for value in ("1.78.0", "1.98.9", "1.102.4", "1.104.1", "1.104.2", "1.104.3"):
            self.assertEqual(security.assess(value)["status"], "below-security-floor")
        for value in ("1.104.4", "v1.104.4", "1.104.4-1", "1.104.10", "1.106.0"):
            self.assertEqual(security.assess(value)["status"], "meets-security-floor")

    def test_unknown_builds_fail_closed(self):
        for value in ("", "stable", "latest", "1.104", "1.104.4-rc1", "1.104.4~rc1", "1.105.0", "2.0.0", "1.104.4+dirty", "1.104.4-tabcdef", "1.104.4\n1.104.2", "01.104.4", "1:1.104.4", "1.104.4-vendor"):
            self.assertEqual(security.assess(value)["status"], "unknown-version", value)

    def test_stale_daemon_fails_even_with_fixed_cli(self):
        result = subprocess.run([sys.executable, str(SCRIPT), "--version", "1.104.4", "--version", "1.104.2"], capture_output=True, text=True)
        self.assertEqual(result.returncode, 1)
        self.assertIn("below-security-floor", result.stdout)

    def test_no_evidence_is_not_a_pass(self):
        result = subprocess.run([sys.executable, str(SCRIPT)], capture_output=True)
        self.assertEqual(result.returncode, 2)

    def test_manifest_rejects_floating_stale_or_mismatched_images(self):
        for version, tag in (("1.104.4", "stable"), ("1.104.4", "v1.104.2"), ("1.78.0", "v1.78.0")):
            with tempfile.TemporaryDirectory() as directory:
                manifest = Path(directory) / "manifest.yml"
                manifest.write_text(f"app:\n  id: tailscale\n  version: {version}\n  container:\n    image: example/tailscale:{tag}\n")
                self.assertNotEqual(security.check_manifest(manifest)["status"], "meets-security-floor")

    def test_owned_manifest_requires_fixed_release(self):
        manifest = SCRIPT.parents[1] / "apps/tailscale/manifest.yml"
        self.assertEqual(security.check_manifest(manifest)["status"], "meets-security-floor")

    def test_iso_first_boot_image_matches_manifest(self):
        import yaml
        root = SCRIPT.parents[1]
        manifest = yaml.safe_load((root / "apps/tailscale/manifest.yml").read_text())["app"]
        image = manifest["container"]["image"]
        registry = image.rsplit("/", 1)[0]
        result = subprocess.run([
            "bash", "-c",
            'ARCHY_REGISTRY="$1"; source "$2"; printf "%s" "$TAILSCALE_IMAGE"',
            "fixture", registry, str(root / "scripts/image-versions.sh"),
        ], check=True, capture_output=True, text=True)
        self.assertEqual(result.stdout, image)
        # Metadata agreement is necessary, but is not binary/image qualification.
        self.assertEqual(security.check_manifest(root / "apps/tailscale/manifest.yml")["status"],
                         "meets-security-floor")


if __name__ == "__main__":
    unittest.main()