from pathlib import Path
import tomllib

ROOT = Path(__file__).resolve().parents[1]


def test_packaged_config_matches_linux_layout():
    config = tomllib.loads((ROOT / "packaging/rustbox.toml").read_text())
    assert config["host"] == "0.0.0.0"
    assert config["data_dir"] == "/var/lib/rustbox"
    assert config["log_dir"] == "/var/log/rustbox"
    assert config["default_interface_skin"] == "apple-mail"
    assert config["max_attachment_size_mb"] == 50
    assert config["max_message_size_mb"] == 100


def test_systemd_hardening_and_paths():
    unit = (ROOT / "packaging/rustbox.service").read_text()
    for needle in (
        "User=rustbox",
        "Group=rustbox",
        "WorkingDirectory=/var/lib/rustbox",
        "ExecStart=/usr/local/bin/rustbox",
        "StateDirectory=rustbox",
        "LogsDirectory=rustbox",
        "ProtectSystem=strict",
        "ProtectHome=true",
        "NoNewPrivileges=true",
        "StandardOutput=null",
    ):
        assert needle in unit


def test_logrotate_keeps_seven_daily_rotations():
    data = (ROOT / "packaging/rustbox.logrotate").read_text()
    assert "/var/log/rustbox/rustbox.log" in data
    assert "daily" in data
    assert "rotate 7" in data
    assert "create 0600 rustbox rustbox" in data


def test_package_runtime_dependencies_are_explicit():
    script = (ROOT / "scripts/prepare-package.sh").read_text()
    for needle in (
        "- gnupg",
        "- libssl3 | libssl3t64",
        "- gnupg2",
        "- openssl-libs",
        "- gpg2",
        "- libopenssl3",
    ):
        assert needle in script


def test_docker_context_excludes_secrets_and_state():
    data = (ROOT / ".dockerignore").read_text().splitlines()
    assert ".env" in data
    assert "gpg/" in data
    assert "data/" in data