from __future__ import annotations

import subprocess
import tempfile
import unittest
from pathlib import Path

from scripts.build_upload_folders import (
    _GITHUB_ARTIFACTS,
    _broken_local_markdown_links,
    _github_gitignore,
    _secret_findings,
)


class UploadFolderGuardrailTest(unittest.TestCase):
    def test_secret_scanner_allows_placeholder_and_rejects_real_token_shape(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            (root / ".env.example").write_text("HF_TOKEN=hf_replace_me\n", encoding="utf-8")
            self.assertEqual(_secret_findings(root), [])
            (root / "bad.txt").write_text("HF_TOKEN=hf_" + "A" * 30, encoding="utf-8")
            self.assertIn("Hugging Face token: bad.txt", _secret_findings(root))

    def test_markdown_guard_rejects_only_broken_local_links(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            (root / "present.md").write_text("ok\n", encoding="utf-8")
            readme = root / "README.md"
            readme.write_text(
                "[local](present.md) [anchor](#section) [web](https://example.com)\n",
                encoding="utf-8",
            )
            self.assertEqual(_broken_local_markdown_links(root), [])
            readme.write_text("[missing](absent.md)\n", encoding="utf-8")
            self.assertEqual(_broken_local_markdown_links(root), ["README.md -> absent.md"])

    def test_generated_gitignore_tracks_only_curated_artifacts(self) -> None:
        with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            (root / ".gitignore").write_text(_github_gitignore(), encoding="utf-8")
            subprocess.run(["git", "init", "-q"], cwd=root, check=True)
            for relative in _GITHUB_ARTIFACTS:
                path = root / relative
                path.parent.mkdir(parents=True, exist_ok=True)
                path.write_bytes(b"curated")
                completed = subprocess.run(
                    ["git", "check-ignore", "--quiet", relative],
                    cwd=root,
                    check=False,
                )
                self.assertEqual(completed.returncode, 1, relative)

            excluded = root / "artifacts" / "debug-run" / "model.pt"
            excluded.parent.mkdir(parents=True)
            excluded.write_bytes(b"excluded")
            completed = subprocess.run(
                ["git", "check-ignore", "--quiet", str(excluded.relative_to(root))],
                cwd=root,
                check=False,
            )
            self.assertEqual(completed.returncode, 0)


if __name__ == "__main__":
    unittest.main()