from pathlib import Path


ROOT = Path(__file__).resolve().parents[3]
SCRIPT = ROOT / "scripts/reboot-recovery/agent99-legacy-sender-quarantine.ps1"
REGISTER_TASKS = ROOT / "agent99-register-tasks.ps1"


def test_legacy_sender_quarantine_is_exact_bounded_and_rollback_ready() -> None:
    source = SCRIPT.read_text(encoding="utf-8")

    assert 'ValidateSet("Check", "Apply", "Verify")' in source
    assert '"Wooo-Agent99-Host188-Performance-Guard"' in source
    assert '"Wooo-Agent99-Performance-Guard"' in source
    assert "a2f98560673ebed5aa1f828b4e577c8a34d1c277b2e498044c3526a4ffe15379" in source
    assert "Export-ScheduledTask" in source
    assert "Disable-ScheduledTask" in source
    assert "Enable-ScheduledTask" in source
    assert "Unregister-ScheduledTask" not in source
    assert "Stop-ScheduledTask" not in source
    assert "Restart-Service" not in source
    assert "Restart-Computer" not in source
    assert r"api\.telegram\.org|sendMessage|BotToken|ChatId" in source
    assert "secretValueRead = $false" in source
    assert "taskDeleted = $false" in source


def test_legacy_sender_quarantine_has_check_apply_verify_receipts() -> None:
    source = SCRIPT.read_text(encoding="utf-8")

    for schema in (
        "agent99_legacy_sender_quarantine_check_v1",
        "agent99_legacy_sender_quarantine_receipt_v1",
        "agent99_legacy_sender_quarantine_verify_v1",
    ):
        assert schema in source
    assert "wouldDisableLegacySender" in source
    assert "durableReceiptAvailable" in source
    assert "controlled_receipt_identity_already_exists" in source
    assert 'identity -in @(".", "..")' in source


def test_task_registration_persists_the_exact_legacy_sender_sunset() -> None:
    source = REGISTER_TASKS.read_text(encoding="utf-8")

    assert '"Wooo-Agent99-Host188-Performance-Guard"' in source
    assert "a2f98560673ebed5aa1f828b4e577c8a34d1c277b2e498044c3526a4ffe15379" in source
    assert "Disable-ScheduledTask" in source
    assert "Unregister-ScheduledTask" not in source
    assert "legacy_host188_sender_action_identity_mismatch" in source
    assert "legacy_host188_sender_running_refuse_quarantine" in source
    assert "legacy_host188_sender_quarantine_post_verifier_failed" in source