tests/test_hf_space_api_deploy_script.py

from __future__ import annotations

from pathlib import Path

from scripts.deploy_hf_space_api import (
    PATHS_TO_COPY,
    build_deploy_folder,
    scan_for_sensitive_contents,
    scan_for_sensitive_paths,
)


def test_build_deploy_folder_copies_expected_backend_files(tmp_path: Path):
    source_root = tmp_path / "source"
    deploy_root = tmp_path / "deploy"
    source_root.mkdir()

    for relative_path in PATHS_TO_COPY:
        path = source_root / relative_path

        if relative_path == "app":
            path.mkdir()
            (path / "__init__.py").write_text("", encoding="utf-8")
            (path / "__pycache__").mkdir()
            (path / "__pycache__" / "bad.pyc").write_bytes(b"bad")
        else:
            path.write_text(f"{relative_path}\n", encoding="utf-8")

    copied = build_deploy_folder(source_root=source_root, deploy_root=deploy_root)

    assert "app" in copied
    assert "Dockerfile" in copied
    assert (deploy_root / "app" / "__init__.py").exists()
    assert (deploy_root / "Dockerfile").exists()
    assert not (deploy_root / "app" / "__pycache__" / "bad.pyc").exists()


def test_scan_for_sensitive_paths_blocks_private_files(tmp_path: Path):
    deploy_root = tmp_path / "deploy"
    deploy_root.mkdir()

    safe_file = deploy_root / "app" / "main.py"
    safe_file.parent.mkdir()
    safe_file.write_text("print('ok')\n", encoding="utf-8")

    secret_file = deploy_root / ".env"
    secret_file.write_text("APP_ENV=production\n", encoding="utf-8")

    findings = scan_for_sensitive_paths(deploy_root)

    assert ".env" in findings


def test_scan_for_sensitive_contents_blocks_secret_values(tmp_path: Path):
    deploy_root = tmp_path / "deploy"
    deploy_root.mkdir()

    file_with_secret = deploy_root / "README.md"
    file_with_secret.write_text(
        "OPENROUTER_API_KEY=must-not-be-deployed\n",
        encoding="utf-8",
    )

    findings = scan_for_sensitive_contents(deploy_root)

    assert "README.md" in findings