from __future__ import annotations

import unittest
from pathlib import Path


ROOT = Path(__file__).resolve().parent


class ImageAndEntrypointIntegrationTests(unittest.TestCase):
    def test_image_contains_xai_proxy_enforcer(self) -> None:
        dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
        self.assertIn("COPY xai_auth_proxy.py /opt/daili/xai_auth_proxy.py", dockerfile)
        self.assertIn("COPY patches/xai_fail_closed.go /tmp/xai_fail_closed.go", dockerfile)
        self.assertIn("go run /tmp/apply_xai_fail_closed.go", dockerfile)
        self.assertIn("go test ./sdk/cliproxy/auth", dockerfile)

    def test_startup_enforces_before_gateway_and_watches_after_management(self) -> None:
        entrypoint = (ROOT / "entrypoint.sh").read_text(encoding="utf-8")
        restore = entrypoint.rindex("restore_objectstore_state || true")
        enforce = entrypoint.rindex("\nenforce_xai_auth_proxies_once\n")
        gateway = entrypoint.rindex('"$GATEWAY_BIN" -config "$GATEWAY_CONFIG_PATH" &')
        watcher = entrypoint.rindex("start_xai_proxy_watch")

        self.assertLess(restore, enforce)
        self.assertLess(enforce, gateway)
        self.assertLess(gateway, watcher)
        self.assertIn('PROXY_URL_VALUE="direct"', entrypoint)
        self.assertNotIn('PROXY_URL_VALUE="socks5h://', entrypoint)
        self.assertIn('XAI_PROXY_FAIL_CLOSED_URL="$XAI_PROXY_FAIL_CLOSED_URL"', entrypoint)

    def test_objectstore_config_is_also_forced_direct(self) -> None:
        source = (ROOT / "objectstore_sync.py").read_text(encoding="utf-8")
        self.assertIn("from xai_auth_proxy import enforce_config_proxy_url", source)
        self.assertIn("def enforce_config_without_mtime_change", source)
        self.assertGreaterEqual(source.count("enforce_config_without_mtime_change(config_path)"), 2)

    def test_secret_staging_directory_is_ignored(self) -> None:
        gitignore = (ROOT / ".gitignore").read_text(encoding="utf-8").splitlines()
        dockerignore = (ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines()
        self.assertIn(".codex-tmp/", gitignore)
        self.assertIn(".codex-tmp", dockerignore)


if __name__ == "__main__":
    unittest.main()