from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]


def test_deploy_uses_uploaded_tar_and_versioned_container():
    script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
    assert 'CONTAINER_NAME="suricata_${VERSION}"' in script
    assert 'ROOT_DIR="/containers/${CONTAINER_NAME}/root"' in script
    assert 'IMAGE_TAR_ROS="${1:-}"' in script
    assert '/container/add name="${CONTAINER_NAME}" file="${IMAGE_TAR_ROS}"' in script
    assert 'build-routeros.sh' not in script
    assert 'ROUTER_ARCH' not in script
    assert '/container/get' not in script


def test_upload_helper_only_accepts_ready_tar():
    script = (ROOT / "scripts" / "upload-routeros-image.sh").read_text()
    assert 'IMAGE_PATH="${1:-}"' in script
    assert 'build-routeros.sh' not in script
    assert 'ROUTER_ARCH' not in script
    assert '/container/add' not in script
    assert '/import' not in script


def test_upgrade_helper_reuses_existing_routeros_setup_only():
    script = (ROOT / "scripts" / "upgrade-routeros-container.sh").read_text()
    assert 'CONTAINER_NAME="suricata_${VERSION}"' in script
    assert 'ROOT_DIR="/containers/${CONTAINER_NAME}/root"' in script
    assert '/container/add name="${CONTAINER_NAME}" file="${IMAGE_TAR_ROS}"' in script
    assert 'interface="${CONTAINER_VETH}"' in script
    assert 'mountlists="${CONTAINER_MOUNTLIST}"' in script
    assert 'envlist="${CONTAINER_ENVLIST}"' in script
    assert '/container/get' not in script
    assert '/interface/bridge/add' not in script
    assert '/interface/veth/add' not in script
    assert '/ip/address/add' not in script
    assert '/ip/firewall/nat/add' not in script
    assert '/tool/sniffer/set' not in script
    assert '/container/envs/add' not in script
    assert '/container/mounts/add list="${CONTAINER_MOUNTLIST}" src="${ROUTER_DISK}/containers/suricata-data" dst=/data' in script


def test_routeros_deploy_uses_one_persistent_data_mount():
    script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
    assert '/container/mounts/add list=IDS_MOUNTS src="${DATA_DIR}" dst=/data' in script
    assert 'suricata-logs' not in script
    assert 'suricata-rules' not in script


def test_compose_uses_one_named_volume():
    compose = (ROOT / "docker-compose.yml").read_text()
    assert compose.count(':/data') == 1
    assert 'routeros-suricata-data' in compose
    assert 'routeros-suricata-logs' not in compose
    assert 'routeros-suricata-rules' not in compose


def test_routeros_deploy_forwards_ndr_and_persistence_controls():
    script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
    for key in (
        "REDIS_AOF", "NDR_ENABLED", "NDR_CORRELATION_WINDOW_SECONDS",
        "BEHAVIOR_MIN_OBSERVATIONS", "NDR_AUTO_BLOCK", "NDR_AUTO_BLOCK_RISK",
        "ROUTEROS_INVENTORY_INTERVAL_SECONDS", "NOTIFY_WEBHOOK_URL",
        "NOTIFY_MIN_RISK", "NOTIFY_TIMEOUT_SECONDS",
        "METRICS_ALLOWED_IPS", "METRICS_BASIC_AUTH_USERNAME",
        "METRICS_BASIC_AUTH_PASSWORD",
    ):
        assert f"key={key}" in script