"""Fail-closed contract for the backend dependency remediation in #2316."""

from __future__ import annotations

from pathlib import Path

ROOT = Path(__file__).resolve().parents[3]


def test_unpatched_asyncmy_driver_is_absent_from_manifest_and_lock() -> None:
    manifest = (ROOT / "server/pyproject.toml").read_text()
    lock = (ROOT / "server/uv.lock").read_text()

    assert '"aiomysql>=0.3.2"' in manifest
    assert '"asyncmy' not in manifest
    assert '\nname = "asyncmy"\n' not in lock
    assert '\nname = "aiomysql"\n' in lock


def test_active_production_runbooks_do_not_recommend_asyncmy() -> None:
    runbook = (ROOT / "docs/ops/cloud-lifecycle-ops.md").read_text()

    assert "HELIX_PROD_DB_URL_ASYNC='mysql+asyncmy://" not in runbook


def test_direct_security_floors_remain_pinned() -> None:
    manifest = (ROOT / "server/pyproject.toml").read_text()
    for requirement in (
        '"fastapi>=0.141.1"',
        '"PyJWT>=2.13.0"',
        '"cryptography>=48.0.1"',
        '"python-multipart>=0.0.31"',
        '"httplib2>=0.32.0"',
        '"mcp>=1.28.1,<2"',
        '"Pillow>=12.3.0"',
        '"alembic>=1.18.5"',
        '"Mako>=1.3.12"',
        '"pyasn1>=0.6.4"',
        '"urllib3>=2.7.0"',
        '"aiohttp>=3.14.1"',
        '"starlette>=1.3.1"',
        '"idna>=3.15"',
        '"pydantic-settings>=2.14.2"',
        '"pytest>=9.0.3"',
        '"Pygments>=2.20.0"',
    ):
        assert requirement in manifest