"""
packaging/audit_deps.py, the pip-audit step of the builds.

What can be checked without the network: a build with no network goes on
(the audit is skipped with a warning, never a failure), what is audited is
what ships, and the ignore list is read as ids. Whether pip-audit stops a
build on a real advisory needs the network and was checked by hand.
"""

import importlib.util
import os
import subprocess
import sys
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[3]
SCRIPT = ROOT / "packaging" / "audit_deps.py"

pytestmark = pytest.mark.skipif(not SCRIPT.exists(), reason="packaging not present")


def _module():
    spec = importlib.util.spec_from_file_location("audit_deps", SCRIPT)
    mod = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(mod)
    return mod


def test_no_network_skips_the_audit_without_failing_the_build(tmp_path):
    # A proxy nobody listens on: every request is refused at once.
    dead = "http://127.0.0.1:9"
    env = {**os.environ, "HTTPS_PROXY": dead, "https_proxy": dead,
           "HTTP_PROXY": dead, "http_proxy": dead}
    run = subprocess.run([sys.executable, str(SCRIPT), "--tool-dir", str(tmp_path / "t")],
                         capture_output=True, text=True, env=env, timeout=60)
    assert run.returncode == 0, run.stderr
    assert "pip-audit skipped: no network" in run.stderr
    assert not (tmp_path / "t").exists(), "nothing is installed when it cannot run"


def test_what_is_audited_is_what_ships():
    names = {line.split("==")[0].lower() for line in _module().shipped()}
    assert "pytest" in names, "the environment's packages are listed"
    assert not {n for n in names if n.startswith("meshbay")}, "ours are not on PyPI"
    assert not names & {"pip", "setuptools", "wheel"}, "build tools do not ship"


def test_the_ignore_list_is_read_as_ids(tmp_path, monkeypatch):
    mod = _module()
    f = tmp_path / "ignore.txt"
    f.write_text("# a comment\n\nPYSEC-2026-1  # not reached: no JWK import\n"
                 "GHSA-xxxx-yyyy-zzzz\n", encoding="utf-8")
    monkeypatch.setattr(mod, "IGNORE_FILE", f)
    assert mod.ignored() == ["PYSEC-2026-1", "GHSA-xxxx-yyyy-zzzz"]


def test_the_shipped_ignore_list_lets_nothing_through_unexplained():
    """Every id in the real file carries its reason."""
    mod = _module()
    for line in mod.IGNORE_FILE.read_text(encoding="utf-8").splitlines():
        if line.strip() and not line.lstrip().startswith("#"):
            assert "#" in line, f"no reason given: {line!r}"