from pathlib import Path
from app import nuclei_catalog


def test_nuclei_catalog_uses_commit_reference_not_tree_sha():
    source = Path("app/nuclei_catalog.py").read_text()
    assert '/git/ref/heads/main' in source
    assert 'sha=commit_sha' in source


def test_nuclei_catalog_rejects_unsafe_protocols_and_posts():
    valid = """id: safe-http-check
info:
  name: Safe check
  severity: info
http:
  - method: GET
    path:
      - "{{BaseURL}}/robots.txt"
    matchers:
      - type: status
        status: [200]
"""
    assert nuclei_catalog.validate_template(valid)=="safe-http-check"
    bad = valid.replace("method: GET", "method: POST")
    import pytest
    with pytest.raises(ValueError):
        nuclei_catalog.validate_template(bad)