from __future__ import annotations

import os
import subprocess
import sys
import tempfile
import unittest
from pathlib import Path

RUNTIME_DIR = Path(__file__).resolve().parents[1] / "deployments" / "offline" / "runtime"
sys.path.insert(0, str(RUNTIME_DIR))
import common  # noqa: E402


class NginxConfigActivationTests(unittest.TestCase):
    def test_activation_remains_readable_under_private_umask(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            config = Path(directory) / "test.conf"
            content = "server { listen 8080; }\n"
            reload_count = 0

            def local_run(args, *, stdin=None):
                self.assertEqual("sudo", args[0])
                self.assertIn(args[1], {"mkdir", "tee", "chmod", "mv"})
                self.assertTrue(Path(args[-1]).is_relative_to(directory))
                if args[1] == "mv":
                    self.assertEqual(0o644, Path(args[-2]).stat().st_mode & 0o777)
                subprocess.run(args[1:], input=stdin, text=True, capture_output=True, check=True)

            def verify_reload():
                nonlocal reload_count
                reload_count += 1
                self.assertEqual(content, config.read_text())
                self.assertEqual(0o644, config.stat().st_mode & 0o777)

            original_umask = os.umask(0o077)
            try:
                for _ in range(2):
                    common.activate_nginx_conf(
                        config, content, execute=local_run, reload_nginx=verify_reload,
                    )
                self.assertEqual(2, reload_count)
            finally:
                os.umask(original_umask)

    def test_atomic_writer_keeps_private_default_permissions(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            config = Path(directory) / "private.conf"

            def local_run(args, *, stdin=None):
                self.assertEqual("sudo", args[0])
                self.assertIn(args[1], {"mkdir", "tee", "mv"})
                self.assertTrue(Path(args[-1]).is_relative_to(directory))
                subprocess.run(args[1:], input=stdin, text=True, capture_output=True, check=True)

            original_umask = os.umask(0o077)
            try:
                common.sudo_write_text_atomic(config, "private\n", execute=local_run)
                self.assertEqual("private\n", config.read_text())
                self.assertEqual(0o600, config.stat().st_mode & 0o777)
            finally:
                os.umask(original_umask)


if __name__ == "__main__":
    unittest.main()