import json

from gitea_dynamic_runner.opensandbox_identity import (
    identity_entry,
    is_runner_sandbox,
    task_environment,
)
from gitea_dynamic_runner.sandbox_kubernetes import allocated_pod_name


def batchsandbox():
    return {
        "metadata": {
            "name": "sandbox-1",
            "labels": {"ci.ddupan.top/runner": "true"},
            "annotations": {
                "sandbox.opensandbox.io/alloc-status": json.dumps(
                    {"pods": ["ci-vm-pod-1"]}
                )
            },
        },
        "spec": {
            "taskTemplate": {
                "spec": {
                    "process": {
                        "env": [
                            {
                                "name": "CI_SPIFFE_ID",
                                "value": "spiffe://ddupan.top/ci/org/repo/test",
                            }
                        ]
                    }
                }
            }
        },
    }


def test_extracts_allocation_and_identity_environment():
    document = batchsandbox()
    assert is_runner_sandbox(document)
    assert allocated_pod_name(document) == "ci-vm-pod-1"
    assert task_environment(document)["CI_SPIFFE_ID"].endswith("/org/repo/test")


def test_entry_binds_exact_pod_agent_and_runner_uid():
    entry = identity_entry(
        sandbox_id="sandbox-1",
        pod_uid="pod-uid",
        spiffe_id="spiffe://ddupan.top/ci/org/repo/test",
    )
    assert entry["spec"]["parentID"].endswith("/sandbox-kata/pod-uid")
    assert entry["spec"]["selectors"] == ["unix:uid:2000"]