"""Point 12: the install must work on a network with no way out.

The factory floor at Tràfilo has no internet. A page that fetches a library from
a CDN there does not load slowly, it does not load: the interface never starts.

The libraries were brought in-house; this is what keeps them there. The failure
mode this guards against is not dramatic - someone adds a `<script src="https://
cdn...">` because it is the quickest way to try something, it works at their desk,
and nobody finds out until the machine is on the shop floor.
"""
import re
import subprocess
from pathlib import Path

import pytest

APP_ROOT = Path(__file__).resolve().parents[1]
TEMPLATES = APP_ROOT / "templates"
STATIC = APP_ROOT / "static"

# Anything loaded by the browser: src=, href=, url(), importScripts, workerSrc.
_EXTERNAL_ASSET_RX = re.compile(
    r"""(?:src|href)\s*=\s*["']https?://""", re.I,
)
_EXTERNAL_URL_RX = re.compile(r"""https?://[^\s"'<>)]+""")

# Hosts a comment may legitimately mention: the check is about what gets fetched,
# not about what gets written down. Only documentation links live here.
_DOC_HOSTS = (
    "tailwindcss.com", "github.com", "bugzilla.mozilla.org",
    "bugs.chromium.org", "bugs.webkit.org", "www.w3.org", "schema.org",
    "developer.mozilla.org",
)


def _tracked_files():
    """The files git knows about, or None when git cannot answer.

    Being outside `vendor/` is not the same as being ours. A scratch copy of a
    library dropped into `static/js/` to debug something looks first-party and is
    not: it is not in the repository, it never reaches the shop floor, and its
    comments are not our comments. Trackedness is the honest test for that.

    Trackedness, and not `.gitignore`: an ignore pattern says nothing about a
    file that is already tracked, so matching patterns would be the wrong
    question.

    When git cannot answer we scan everything, as before. A guard test that goes
    quiet the moment it loses its footing is worse than one that cries wolf.
    """
    try:
        listed = subprocess.run(
            ["git", "ls-files", "-z"],
            cwd=APP_ROOT, capture_output=True, text=True, check=True,
        ).stdout
    except (OSError, subprocess.SubprocessError):
        return None
    return {(APP_ROOT / name).resolve() for name in listed.split("\0") if name}


def _first_party_files(suffixes):
    tracked = _tracked_files()

    def is_ours(path):
        return tracked is None or path.resolve() in tracked

    for path in sorted(STATIC.rglob("*")):
        if path.suffix in suffixes and "vendor" not in path.parts and is_ours(path):
            yield path
    for path in sorted(TEMPLATES.rglob("*.html")):
        if is_ours(path):
            yield path


def test_no_template_loads_anything_from_the_network():
    """A src= or href= pointing outside is the whole bug, in one line."""
    offenders = []
    for path in sorted(TEMPLATES.rglob("*.html")):
        for n, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
            if _EXTERNAL_ASSET_RX.search(line):
                offenders.append(f"{path.relative_to(APP_ROOT)}:{n}")
    assert not offenders, f"asset caricati dalla rete: {offenders}"


def test_no_first_party_script_calls_out():
    """Not only tags: a fetch() or a workerSrc reaches the network just the same."""
    offenders = []
    for path in _first_party_files({".js", ".css"}):
        for n, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
            for url in _EXTERNAL_URL_RX.findall(line):
                if any(host in url for host in _DOC_HOSTS):
                    continue
                offenders.append(f"{path.relative_to(APP_ROOT)}:{n} {url}")
    assert not offenders, f"riferimenti esterni: {offenders}"


def test_the_libraries_are_actually_in_the_box():
    """Repointing the tags without shipping the files is the same white screen."""
    vendor = STATIC / "vendor"
    missing = [
        name for name in (
            "alpinejs-3.15.12.min.js",
            "plotly-2.32.0.min.js",
            "pdf-3.11.174.min.js",
            "pdf.worker-3.11.174.min.js",
            "fabric-5.3.1.min.js",
            "fonts.css",
        )
        if not (vendor / name).is_file()
    ]
    assert not missing, f"librerie dichiarate ma non presenti: {missing}"
    assert list((vendor / "fonts").glob("*.woff2")), "i font non sono nel pacchetto"


def test_the_pdf_worker_is_local_everywhere_it_is_set():
    """The trap of this point: the library loads from disk and its worker does not.

    Everything looks right until someone opens a drawing.
    """
    setters = []
    for path in sorted(TEMPLATES.rglob("*.html")):
        text = path.read_text(encoding="utf-8")
        if "workerSrc" not in text:
            continue
        setters.append(path.relative_to(APP_ROOT).as_posix())
        for n, line in enumerate(text.splitlines(), 1):
            if "workerSrc" in line:
                assert "vendor/pdf.worker" in line, (
                    f"{path.relative_to(APP_ROOT)}:{n} punta il worker fuori casa"
                )
    # Five templates render PDFs; if that number changes the new one needs the
    # worker set too, and this is where you find out.
    # #65: da quattro a cinque, task_execute.html mostra PDF nelle note e negli
    # allegati dell'esecuzione (#55).
    assert len(setters) == 5,f"template che impostano il worker: {setters}"


def test_the_shipped_libraries_are_the_ones_that_were_checked():
    """The fingerprints in VERSIONS.md are the record of what was validated.

    A library swapped in place - a hurried patch, a bad merge, something worse -
    keeps the same filename and the same version in the table. The hash is the
    only part that notices.
    """
    vendor = STATIC / "vendor"
    recorded = dict(
        (name, digest)
        for digest, name in (
            line.split(maxsplit=1)
            for line in (
                l.strip() for l in
                (vendor / "VERSIONS.md").read_text(encoding="utf-8").splitlines()
            )
            if re.fullmatch(r"[0-9a-f]{64}\s+\S+", line)
        )
    )
    assert recorded, "VERSIONS.md non elenca più le impronte"

    import hashlib
    wrong = []
    for name, digest in recorded.items():
        path = vendor / name
        if not path.is_file():
            wrong.append(f"{name}: assente")
            continue
        actual = hashlib.sha256(path.read_bytes()).hexdigest()
        if actual != digest:
            wrong.append(f"{name}: {actual} != {digest}")
    assert not wrong, f"librerie diverse da quelle validate: {wrong}"


def test_the_versions_are_pinned():
    """No `3.x.x`: a library that updates itself changes an audit system without
    anyone validating it. The filenames on disk carry the version."""
    vendor = STATIC / "vendor"
    unpinned = [
        p.name for p in vendor.glob("*.js")
        if not re.search(r"-\d+\.\d+\.\d+(\.min)?\.js$", p.name)
    ]
    assert not unpinned, f"librerie senza versione nel nome: {unpinned}"


# ---------------------------------------------------------------------------
# The policy that keeps it that way
# ---------------------------------------------------------------------------


PAGES = ["/auth/login", "/"]


@pytest.mark.parametrize("path", PAGES)
def test_every_page_carries_the_policy(client, path):
    resp = client.get(path, follow_redirects=False)
    csp = resp.headers.get("Content-Security-Policy", "")
    assert "default-src 'self'" in csp
    assert "connect-src 'self'" in csp
    # No CDN host may be allowed back in through the policy itself.
    assert "http://" not in csp and "https://" not in csp


def test_the_policy_allows_what_the_app_actually_needs(client):
    """A policy that breaks the interface gets removed, and then it protects
    nothing. These are the four allowances the libraries genuinely require."""
    csp = client.get("/auth/login").headers["Content-Security-Policy"]
    assert "'unsafe-eval'" in csp        # Alpine 3, Plotly
    assert "'unsafe-inline'" in csp      # componenti Alpine nei template
    assert "worker-src 'self' blob:" in csp   # worker di PDF.js
    assert "img-src 'self' data: blob:" in csp  # canvas Fabric, miniature