tests/test_space_static.py

import ast
import hashlib
import re
import unittest
from pathlib import Path

import provenance
from i2i_contract import CONTENT_MODERATION_ENABLED, PUBLIC_ERROR_MESSAGES


ROOT = Path(__file__).resolve().parents[1]


class SpaceStaticTests(unittest.TestCase):
    def test_remote_assets_are_pinned_and_candidate_count_is_stable(self):
        provenance.assert_pinned_provenance()
        self.assertEqual(len(provenance.CANDIDATE_ADAPTER_SPECS), 19)
        self.assertEqual(set(provenance.ENABLED_ADAPTER_SPECS), set(provenance.CANDIDATE_ADAPTER_SPECS))
        for spec in provenance.CANDIDATE_ADAPTER_SPECS.values():
            self.assertRegex(spec.revision, r"^[0-9a-f]{40}$")
            self.assertNotEqual(spec.revision, "main")

    def test_content_moderation_is_explicitly_disabled(self):
        self.assertIs(CONTENT_MODERATION_ENABLED, False)
        app_source = (ROOT / "app.py").read_text(encoding="utf-8")
        self.assertIn("content_moderation_enabled", app_source)
        forbidden = ["safety_checker", "nsfw_classifier", "prompt_blocklist"]
        for marker in forbidden:
            self.assertNotIn(marker, app_source.lower())

    def test_public_error_codes_are_exact_and_low_cardinality(self):
        self.assertEqual(
            set(PUBLIC_ERROR_MESSAGES),
            {
                "I2I_BAD_REQUEST",
                "I2I_UNSUPPORTED_TYPE",
                "I2I_FILE_TOO_LARGE",
                "I2I_IMAGE_DECODE_FAILED",
                "I2I_IMAGE_DIMENSIONS_INVALID",
                "I2I_PROMPT_REQUIRED",
                "I2I_PROMPT_TOO_LONG",
                "I2I_LORA_NOT_ALLOWED",
                "I2I_PROVIDER_BUSY",
                "I2I_INFERENCE_FAILED",
                "I2I_INVALID_OUTPUT",
            },
        )
        source = (ROOT / "app.py").read_text(encoding="utf-8")
        self.assertIn("return message in {", source)
        self.assertNotIn('message.startswith(f"{code}:")', source)

    def test_edit_endpoint_has_seven_fields_and_serial_concurrency(self):
        tree = ast.parse((ROOT / "app.py").read_text(encoding="utf-8"))
        function = next(node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == "edit_image")
        self.assertEqual(
            [argument.arg for argument in function.args.args],
            [
                "images_b64_json",
                "prompt",
                "lora_adapter",
                "seed",
                "randomize_seed",
                "guidance_scale",
                "steps",
            ],
        )
        decorator = ast.unparse(function.decorator_list[0])
        self.assertIn("name='edit_image'", decorator)
        self.assertIn("concurrency_limit=1", decorator)
        self.assertIn("concurrency_id='i2i-pipeline'", decorator)

    def test_gpu_is_internal_and_mcp_and_raw_errors_are_disabled(self):
        source = (ROOT / "app.py").read_text(encoding="utf-8")
        self.assertIn('@spaces.GPU(size="xlarge")', source)
        self.assertNotIn("@app.mcp.tool", source)
        self.assertIn("show_error=False", source)
        self.assertIn("mcp_server=False", source)
        self.assertNotRegex(source, r"\{\s*(?:e|exc)\s*\}")
        self.assertNotIn("str(exc)", source)
        self.assertNotIn("traceback", source)
        self.assertIn("load_lora_weights", source)
        self.assertIn("revision=spec.revision", source)
        self.assertIn("set_adapters", source)
        self.assertIn("unload_lora_weights", source)
        self.assertIn("SingleResidentAdapterManager", source)

    def test_public_runtime_has_general_default_and_19_opt_in_loras(self):
        source = (ROOT / "app.py").read_text(encoding="utf-8")
        self.assertIn('"edit_mode": "general-and-lora"', source)
        self.assertIn('"uses_lora": True', source)
        self.assertIn('"supports_general_mode": True', source)
        self.assertIn('"default_edit_mode": BASE_EDIT_MODE_ID', source)
        self.assertIn("allowed_edit_modes={BASE_EDIT_MODE_ID, *ENABLED_ADAPTER_SPECS}", source)

    def test_homepage_is_a_hardened_full_feature_editor(self):
        html = (ROOT / "index.html").read_text(encoding="utf-8")
        script = (ROOT / "assets" / "app-ui.js").read_text(encoding="utf-8")

        self.assertIn('src="/hy3d-assets/app-ui.js"', html)
        self.assertIn('accept="image/png,image/jpeg,image/webp"', html)
        self.assertIn(" multiple", html)
        self.assertIn("Style / LoRA", html)
        self.assertIn('id="tab-examples"', html)
        self.assertIn('id="examples-scroll"', html)
        self.assertNotRegex(html, r'<(?:script|link)[^>]+(?:src|href)=["\']https?://')
        self.assertNotIn("googleapis", html.lower())
        self.assertNotIn("jsdelivr", html.lower())

        self.assertIn('const GENERAL_MODE_ID = "__base__"', script)
        self.assertIn('const EXPECTED_API_VERSION = "2026-08-12.3"', script)
        self.assertIn("images_b64_json: JSON.stringify(inputSnapshot)", script)
        self.assertIn("lora_adapter: editMode", script)
        self.assertIn('events: ["data", "status"]', script)
        self.assertIn("await currentJob.wait_for_id()", script)
        self.assertIn("await job.return()", script)
        self.assertIn("config.uses_lora !== true", script)
        self.assertIn("config.loras.length !== EXPECTED_LORA_IDS.length", script)
        self.assertIn("nextLimits.input_images !== 2", script)
        self.assertIn("nextLimits.min_input_images !== 1", script)
        self.assertIn("nextLimits.max_input_images !== 2", script)
        self.assertIn('client.predict("/load_example", { idx: index })', script)
        self.assertIn("Stopped waiting for this job. The backend may still finish it.", script)
        self.assertNotIn("Queued job cancelled", script)
        self.assertNotIn('hideLoader("Cancelled")', script)
        self.assertIn('"Anime-V2"', script)
        self.assertIn('"Photo-to-Anime"', script)
        self.assertIn('"General / No LoRA"', script)
        lora_block = re.search(r"const EXPECTED_LORA_IDS = Object\.freeze\(\[(.*?)\]\);", script, re.DOTALL)
        self.assertIsNotNone(lora_block)
        ui_loras = re.findall(r'^\s*"([^"]+)",?$', lora_block.group(1), re.MULTILINE)
        self.assertEqual(ui_loras, list(provenance.CANDIDATE_ADAPTER_SPECS))
        suggestion_block = re.search(r"const SUGGESTIONS = Object\.freeze\(\[(.*?)\]\);", script, re.DOTALL)
        self.assertIsNotNone(suggestion_block)
        self.assertEqual(len(re.findall(r'^\s*\["', suggestion_block.group(1), re.MULTILINE)), 16)
        suggestion_handler = re.search(r"SUGGESTIONS\.forEach\(.*?\n\}\);", script, re.DOTALL)
        self.assertIsNotNone(suggestion_handler)
        self.assertNotIn("loraSelect", suggestion_handler.group(0))
        self.assertIn('["Upscale / Enhance", "Enhance clarity and fine detail while preserving the original composition."]', script)
        self.assertNotIn("Upscale 4K", script)
        self.assertNotIn("4K resolution", script)
        self.assertNotIn("card.innerHTML", script)
        self.assertIn("card.append(thumbnails, meta, promptText)", script)

        self.assertIn('class="dot pending"', html)
        self.assertIn("4 STEPS DEFAULT", html)
        self.assertNotIn(".gh-btn", html)
        self.assertIn(".site-btn{padding:6px 10px}", html)
        self.assertLess(html.index('class="inspector"'), html.index('class="workspace"'))
        self.assertIn('id="sb-status" role="status" aria-live="polite"', html)
        self.assertIn('toast.setAttribute("aria-live"', script)
        self.assertIn("studio.inert = true", script)
        self.assertIn("function isLightboxOpen()", script)
        self.assertGreaterEqual(script.count("if (isLightboxOpen()) return;"), 3)
        input_strip = re.search(r"function renderInputStrip\(\) \{(.*?)\n\}", script, re.DOTALL)
        self.assertIsNotNone(input_strip)
        self.assertIn('const select = document.createElement("button")', input_strip.group(1))
        self.assertIn('select.type = "button"', input_strip.group(1))
        self.assertIn('select.className = "fs-thumb-select"', input_strip.group(1))
        self.assertIn('select.setAttribute("aria-label", `Select input image ${index + 1}`)', input_strip.group(1))
        self.assertIn('select.setAttribute("aria-pressed", String(index === selectedImageIndex))', input_strip.group(1))
        self.assertIn("select.append(image, badge)", input_strip.group(1))
        self.assertIn("thumb.append(select, remove)", input_strip.group(1))
        self.assertNotIn('thumb.addEventListener("click"', input_strip.group(1))
        self.assertIn(".fs-thumb-select:focus-visible", html)

    def test_browser_client_is_exactly_vendored(self):
        client_path = ROOT / "assets" / "gradio-client-2.3.1.js"
        self.assertTrue(client_path.is_file())
        digest = hashlib.sha256(client_path.read_bytes()).hexdigest()
        self.assertEqual(digest, "a3d50dc5f3590c5723695abcd85e2009c42a8af08bfc9fa47a7baecc1040c0be")

    def test_interactive_script_only_references_unique_existing_dom_ids(self):
        html = (ROOT / "index.html").read_text(encoding="utf-8")
        script = (ROOT / "assets" / "app-ui.js").read_text(encoding="utf-8")
        element_ids = re.findall(r'\bid=["\']([^"\']+)["\']', html)
        script_refs = set(re.findall(r'getElementById\(["\']([^"\']+)["\']\)', script))
        script_created_ids = set(re.findall(r'\.id\s*=\s*["\']([^"\']+)["\']', script))

        self.assertEqual(len(element_ids), len(set(element_ids)))
        self.assertEqual(script_refs - set(element_ids) - script_created_ids, set())

    def test_ui_assets_and_homepage_are_no_store_and_allowlisted(self):
        source = (ROOT / "app.py").read_text(encoding="utf-8")
        self.assertIn('"Cache-Control": "no-store, max-age=0, must-revalidate"', source)
        self.assertIn('@app.get("/hy3d-assets/{asset_name}"', source)
        self.assertIn('{"app-ui.js", "gradio-client-2.3.1.js"}', source)

    def test_direct_python_dependencies_are_exact(self):
        requirements = (ROOT / "requirements.txt").read_text(encoding="utf-8").splitlines()
        packages = [line for line in requirements if line and not line.startswith("--")]
        self.assertTrue(packages)
        for package in packages:
            self.assertRegex(package, r"^[A-Za-z0-9_.-]+==[^=<>~]+$")
        self.assertEqual((ROOT / "pre-requirements.txt").read_text(encoding="utf-8").strip(), "pip==26.1.2")

    def test_examples_are_fixed_non_gpu_api_assets(self):
        source = (ROOT / "app.py").read_text(encoding="utf-8")
        self.assertIn('@app.api(name="load_example", queue=False)', source)
        self.assertIn("def load_example(idx: float) -> dict", source)
        self.assertIn("parse_example_index", source)
        self.assertIn("EXAMPLES_CONFIG", source)
        self.assertIn("blocked_paths=[examples_path]", source)

    def test_kernel_revision_is_pinned(self):
        source = (ROOT / "qwenimage" / "qwen_fa3_processor.py").read_text(encoding="utf-8")
        self.assertIn("from provenance import KERNEL_MODEL_REVISION", source)
        self.assertIn("revision=KERNEL_MODEL_REVISION", source)
        self.assertIsNone(re.search(r'get_kernel\([^)]*revision\s*=\s*["\']main["\']', source, re.DOTALL))


if __name__ == "__main__":
    unittest.main()