"""校验渲染后的环境隔离与引用关系，无网络、集群写入或凭据访问。"""
from pathlib import Path
import re
import subprocess
import unittest

import yaml

ROOT = Path(__file__).resolve().parents[1] / 'ayatori'


def render(environment):
    return list(yaml.safe_load_all(subprocess.check_output(
        ['kubectl', 'kustomize', str(ROOT / environment)], text=True)))


class AyatoriManifestTests(unittest.TestCase):
    def test_common_entry_cannot_register_instances_or_sync_credentials(self):
        objects = render('.')
        self.assertEqual([x['kind'] for x in objects], ['ConfigMap'])
        self.assertEqual(objects[0]['metadata']['namespace'], 'ayatori-system')

    def test_environment_isolation_scope_and_references(self):
        for env, address, port in [('dev', '192.168.10.127', 5433), ('prod', '192.168.10.2', 5432)]:
            with self.subTest(environment=env):
                objects = render(env)
                self.assertEqual(sorted(x['kind'] for x in objects),
                                 ['ConfigMap', 'ExternalSecret', 'PostgreSQLInstance'])
                instance = next(x for x in objects if x['kind'] == 'PostgreSQLInstance')
                secret = next(x for x in objects if x['kind'] == 'ExternalSecret')
                self.assertNotIn('namespace', instance['metadata'])
                self.assertEqual(instance['metadata']['name'], 'homelab-' + env)
                self.assertEqual(instance['spec']['endpoint'], {
                    'host': 'pg-' + env + '.ad.ddupan.top', 'hostaddr': address,
                    'port': port, 'database': 'postgres', 'sslMode': 'verify-full'})
                self.assertEqual(secret['metadata']['namespace'], 'ayatori-system')
                self.assertEqual(instance['spec']['adminCredentialRef']['name'], secret['spec']['target']['name'])
                self.assertEqual(secret['spec']['secretStoreRef'],
                                 {'name': 'homelab-postgresql-' + env + '-admin', 'kind': 'SecretStore'})
                self.assertEqual({x['remoteRef']['key'] for x in secret['spec']['data']},
                                 {'infra/postgresql/ayatori/' + env})
                self.assertEqual({x['secretKey'] for x in secret['spec']['data']}, {'username', 'password'})
                self.assertEqual({x['remoteRef']['property'] for x in secret['spec']['data']}, {'username', 'password'})
                policy = (ROOT / env / 'eso-policy.hcl').read_text()
                self.assertEqual(re.findall(r'path\s+"([^"]+)"', policy),
                                 ['kv/data/infra/postgresql/ayatori/' + env])
                self.assertEqual(re.findall(r'capabilities\s*=\s*\[([^]]+)\]', policy), ['"read"'])


if __name__ == '__main__':
    unittest.main()