from pathlib import Path


ROOT = Path(__file__).resolve().parents[3]
BASELINE = ROOT / "agent99-windows-control-baseline.ps1"
CONTROL_PLANE = ROOT / "agent99-control-plane.ps1"


def _source() -> str:
    return BASELINE.read_text(encoding="utf-8")


def test_baseline_is_canonical_windows99_user_scoped_and_preserves_zh_tw() -> None:
    source = _source()

    assert '$CanonicalAsset = "host:192.168.0.99/windows-control-baseline"' in source
    assert '$ExpectedComputerName = "WOOO-SUPER"' in source
    assert '$ExpectedUserName = "Administrator"' in source
    assert '$PreservedCulture = "zh-TW"' in source
    assert '$PreservedChineseLanguage = "zh-Hant-TW"' in source
    assert '$FallbackLanguage = "en-US"' in source
    assert '$FallbackInputTip = "0409:00000409"' in source
    assert "priorInputMethodsPreserved" in source
    assert "missingPreservedLanguageSignatures" in source


def test_baseline_supports_check_apply_independent_verify_and_rollback() -> None:
    source = _source()

    assert '[ValidateSet("Check", "Apply")]' in source
    assert "TraceId" in source
    assert "RunId" in source
    assert "WorkItemId" in source
    assert "SourceRevision" in source
    assert "Invoke-IndependentSnapshot" in source
    assert '"-EncodedCommand", $encoded' in source
    assert "Test-WindowsControlSnapshot" in source
    assert "Restore-WindowsControlBaseline" in source
    assert '"verified_check_no_write"' in source
    assert '"runtime_verified_controlled_apply"' in source
    assert '"rolled_back_verified"' in source
    assert '"degraded_with_safe_next_action"' in source


def test_baseline_accepts_transport_run_ids_but_hashes_the_evidence_filename() -> None:
    source = _source()

    safe_identity_pattern = "^[A-Za-z0-9][A-Za-z0-9._:@+-]{0,127}$"
    assert source.count(f'[ValidatePattern("{safe_identity_pattern}")]') == 3
    assert "function Get-AgentRunEvidenceToken" in source
    assert "$EvidenceRunToken = Get-AgentRunEvidenceToken -Value $RunId" in source
    assert '"agent99-WindowsControlBaseline-$EvidenceRunToken.json"' in source
    assert '"agent99-WindowsControlBaseline-$RunId.json"' not in source
    assert 'algorithm = "sha256_utf8"' in source
    assert "runToken = $EvidenceRunToken" in source
    assert "rawIdentityInFileName = $false" in source


def test_control_plane_reads_the_same_hashed_baseline_receipt() -> None:
    source = CONTROL_PLANE.read_text(encoding="utf-8")

    assert "function Get-AgentSha256Hex" in source
    assert "$evidenceRunToken = Get-AgentSha256Hex $runId" in source
    assert '"agent99-WindowsControlBaseline-$evidenceRunToken.json"' in source
    assert '"agent99-WindowsControlBaseline-$runId.json"' not in source
    assert '[string]$receipt.evidenceIdentity.algorithm -eq "sha256_utf8"' in source
    assert '[string]$receipt.evidenceIdentity.runToken -eq $evidenceRunToken' in source
    assert "$receipt.evidenceIdentity.rawIdentityInFileName -eq $false" in source


def test_baseline_sets_only_the_bounded_control_settings() -> None:
    source = _source()

    assert "Set-WinUserLanguageList" in source
    assert "Set-WinDefaultInputMethodOverride" in source
    assert 'New-ItemProperty -Path $ConsoleRegistryPath -Name "CodePage"' in source
    assert 'Set-Service -Name "sshd" -StartupType Automatic' in source
    assert 'Start-Service -Name "sshd"' in source
    assert "Invoke-Expression" not in source
    assert "Set-WinSystemLocale" not in source
    assert "Set-Culture" not in source
    assert "Restart-Computer" not in source
    assert "Stop-Computer" not in source
    assert "shutdown.exe" not in source
    assert "logoff.exe" not in source


def test_baseline_receipt_marks_noninteractive_utf8_boundaries() -> None:
    source = _source()

    assert "[Console]::InputEncoding = [System.Text.UTF8Encoding]::new($false)" in source
    assert "[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)" in source
    assert 'guiInteraction = $false' in source
    assert 'clipboardUsed = $false' in source
    assert 'secretValueRead = $false' in source
    assert 'encodedCommandCompatible = $true' in source
    assert 'interactiveInputRequired = $false' in source
    assert 'inputMethodIndependent = $true' in source
    assert 'utf8Output = $true' in source
    assert 'telegramNotificationSent = $false' in source
    assert 'kmRagWritebackPerformed = $false' in source


def test_baseline_normalizes_windows_collection_and_keyboard_objects() -> None:
    source = _source()

    assert "foreach ($language in $languageList)" in source
    assert '$override.PSObject.Properties["InputMethodTip"]' in source
    assert "Get-DefaultInputMethodTip" in source
    assert "Test-WindowsControlSnapshot $independentReadback.snapshot $before -IndependentProcess" in source
    assert "uiCulture = [string]$Snapshot.uiCulture" not in source
    assert "([string]$Snapshot.userName).ToLowerInvariant()" in source