"""Runnable check for the /audio/{name} path-traversal guard: python test_download_name.py"""
import os
import uuid

os.environ.setdefault("API_KEY", "test")
os.environ.setdefault("OUT_DIR", "/tmp/audio-test")

from fastapi import HTTPException

from app import download


def rejected(name):
    try:
        download(name)
    except HTTPException as e:
        return e.status_code == 400
    return False


# a real uuid name passes validation (it 404s for a missing file, not 400)
for good in (f"{uuid.uuid4().hex}.wav", f"{uuid.uuid4().hex}.srt"):
    assert not rejected(good), good

for bad in [
    "../../etc/passwd",
    "../" * 4 + "x.wav",
    "/etc/passwd",
    "short.wav",
    f"{uuid.uuid4().hex}.mp3",
    f"{'../a' * 8}.wav",  # 36 chars, but not alnum
]:
    assert rejected(bad), bad

print("ok")