# SPDX-License-Identifier: GPL-3.0-or-later

"""Regression checks for the opt-in Go validation service."""

from pathlib import Path
import unittest


ROOT = Path(__file__).resolve().parents[1]
UNIT = ROOT / "systemd" / "enodia-sentinel-go-sidecar.service"


class GoSidecarPackagingTests(unittest.TestCase):
    def test_unit_is_isolated_and_opt_in(self) -> None:
        text = UNIT.read_text(encoding="utf-8")
        self.assertIn("ExecStart=/usr/bin/env enodia-sentinel-go ", text)
        self.assertIn("--state-dir /var/lib/enodia-sentinel-go", text)
        self.assertIn("--event-log /var/lib/enodia-sentinel-go/events.jsonl", text)
        self.assertIn("--event-log-max-bytes 67108864", text)
        self.assertIn("--snapshot-dir /var/lib/enodia-sentinel-go", text)
        self.assertIn("--ebpf-exec --ebpf-syscall", text)
        self.assertIn("StandardOutput=journal", text)
        self.assertIn("InaccessiblePaths=-/var/log/enodia-sentinel", text)
        self.assertNotIn("Alias=enodia-sentinel.service", text)

    def test_unit_keeps_required_hardening(self) -> None:
        text = UNIT.read_text(encoding="utf-8")
        for directive in (
            "ProtectSystem=strict",
            "ProtectHome=read-only",
            "NoNewPrivileges=yes",
            "MemoryDenyWriteExecute=yes",
            "StateDirectory=enodia-sentinel-go",
            "LimitMEMLOCK=infinity",
            "Type=notify",
            "NotifyAccess=main",
            "PrivateDevices=yes",
            "RestrictAddressFamilies=AF_UNIX AF_NETLINK",
            "SystemCallArchitectures=native",
        ):
            with self.subTest(directive=directive):
                self.assertIn(directive, text)

    def test_install_requires_explicit_go_target(self) -> None:
        makefile = (ROOT / "Makefile").read_text(encoding="utf-8")
        default_install = makefile.split("\ninstall-go:", 1)[0]
        self.assertNotIn("enodia-sentinel-go-sidecar.service", default_install)
        self.assertIn("install-go: build-go", makefile)
        self.assertIn("enable-go:", makefile)


if __name__ == "__main__":
    unittest.main()