awoooi/scripts/reboot-recovery/tests/test_windows99_vmx_source_repair_package.py

from __future__ import annotations

import importlib.util
import json
import os
import subprocess
from pathlib import Path


ROOT = Path(__file__).resolve().parents[3]
SCRIPT = (
    ROOT
    / "scripts"
    / "reboot-recovery"
    / "build-windows99-vmx-source-repair-package.py"
)


def _load_module():
    spec = importlib.util.spec_from_file_location(
        "windows99_vmx_source_repair_package",
        SCRIPT,
    )
    assert spec is not None
    module = importlib.util.module_from_spec(spec)
    assert spec.loader is not None
    spec.loader.exec_module(module)
    return module


def _scorecard() -> dict:
    return {
        "status": "blocked_reboot_auto_recovery_slo_not_ready",
        "generated_at": "2026-07-03T10:45:28+08:00",
        "windows99_vmware_autostart": {
            "required_vm_aliases": ["111", "188", "120", "121", "112"],
            "missing_vmx_aliases": ["111"],
            "powered_off_aliases": ["111", "112", "120", "121", "188"],
        },
        "readback": {
            "windows99_no_secret_collector_status": (
                "collected_windows99_vmware_verify_stdout"
            )
        },
    }


def test_package_routes_missing_vmx_to_source_repair_check_mode() -> None:
    module = _load_module()

    payload = module.build_package(
        _scorecard(),
        generated_at="2026-07-03T10:46:00+08:00",
    )

    assert payload["schema_version"] == (
        "windows99_vmx_source_repair_check_mode_package_v1"
    )
    assert payload["status"] == (
        "check_mode_package_ready_windows99_vmx_source_repair_required"
    )
    assert payload["package_ready"] is True
    assert payload["apply_allowed_by_this_package"] is False
    assert payload["missing_vmx_aliases"] == ["111"]
    assert payload["safe_next_step"] == (
        "restore_windows99_missing_vmx_source_for_aliases_then_rerun_no_secret_"
        "collector_and_scorecard_no_vm_power_change"
    )
    row_by_alias = {row["alias"]: row for row in payload["vm_rows"]}
    assert row_by_alias["111"]["missing_vmx_source"] is True
    assert row_by_alias["111"]["controlled_restore_required"] is True
    assert row_by_alias["111"]["check_mode_probe_commands"] == [
        (
            "Test-Path -LiteralPath 'D:\\Documents\\Virtual Machines\\"
            "192.168.0.111_Ubuntu_64-bit\\192.168.0.111_Ubuntu_64-bit.vmx'"
        )
    ]
    assert payload["work_order_id"] == "windows99-vmx-source-repair-111"
    assert payload["action_stage"] == "source_repair_check_mode_ready"
    assert (
        payload["next_executable_step"]
        == "locate_or_relink_missing_vmx_source_check_mode"
    )
    assert payload["check_mode_allowed_by_this_package"] is True
    assert payload["rollback_required"] is True
    assert payload["vm_power_change_allowed"] is False
    assert payload["destructive_restore_allowed"] is False
    action_chain = payload["action_chain"]
    assert action_chain["target_selector"]["vm_aliases"] == ["111"]
    assert action_chain["source_of_truth_diff"][0]["current_state"] == (
        "expected_vmx_source_missing"
    )
    assert action_chain["check_mode"]["probe_command_count"] == 1
    assert action_chain["controlled_apply_candidate"]["executor"] == (
        "windows99_no_secret_management_channel_or_local_console"
    )
    assert action_chain["execution_boundary"]["execution_authorized_by_this_package"] is False
    assert action_chain["post_apply_verifier_count"] == 5
    assert action_chain["learning_writeback_ref_count"] == 6
    assert payload["target_vm_aliases"] == ["111"]
    assert payload["check_mode_probe_command_count"] == 1
    assert payload["controlled_apply_candidate_status"] == (
        "candidate_waiting_existing_vmx_source_or_backup_path"
    )
    assert payload["controlled_apply_candidate_executor"] == (
        "windows99_no_secret_management_channel_or_local_console"
    )
    assert payload["post_apply_verifier_count"] == 5
    assert payload["learning_writeback_ref_count"] == 6
    assert payload["km_writeback_ref"].startswith("km://awoooi/reboot-slo/")
    assert payload["playbook_trust_writeback_ref"].startswith(
        "playbook://awoooi/windows99-vmx-source-repair/"
    )
    assert row_by_alias["188"]["missing_vmx_source"] is False
    assert payload["operation_boundaries"]["vm_power_change_performed"] is False
    assert payload["operation_boundaries"]["secret_value_read"] is False
    assert "vm_power_change" in payload["forbidden_actions"]
    assert "read_windows_password_or_secret" in payload["forbidden_actions"]


def test_package_prefers_existing_scorecard_package_readback() -> None:
    module = _load_module()
    scorecard = _scorecard()
    scorecard["windows99_vmx_source_repair_package"] = {
        "schema_version": "windows99_vmx_source_repair_check_mode_package_v1",
        "sentinel": "from_scorecard_api",
    }

    payload = module.build_package(scorecard)

    assert payload["sentinel"] == "from_scorecard_api"


def test_package_routes_power_only_to_autostart_check_mode() -> None:
    module = _load_module()
    scorecard = _scorecard()
    scorecard["windows99_vmware_autostart"]["missing_vmx_aliases"] = []

    payload = module.build_package(scorecard)

    assert payload["status"] == (
        "check_mode_package_ready_windows99_power_check_required"
    )
    assert payload["safe_next_step"] == (
        "run_windows99_vmware_autostart_check_mode_package_for_powered_off_"
        "aliases_then_rerun_no_secret_collector_no_vm_power_change"
    )
    assert payload["vm_rows"][0]["powered_off"] is True
    assert payload["apply_allowed_by_this_package"] is False
    assert payload["action_stage"] == "power_readback_check_mode_ready"
    assert payload["next_executable_step"] == (
        "build_vmware_autostart_power_readback_check_mode"
    )


def test_cli_writes_package_file(tmp_path: Path) -> None:
    scorecard = tmp_path / "scorecard.json"
    output = tmp_path / "package.json"
    scorecard.write_text(json.dumps(_scorecard()), encoding="utf-8")

    result = subprocess.run(
        [
            "python3.11",
            str(SCRIPT),
            "--scorecard-file",
            str(scorecard),
            "--generated-at",
            "2026-07-03T10:46:00+08:00",
            "--output",
            str(output),
        ],
        cwd=ROOT,
        capture_output=True,
        text=True,
        check=False,
        env={key: value for key, value in os.environ.items() if key != "DATABASE_URL"},
    )

    assert result.returncode == 0
    payload = json.loads(output.read_text(encoding="utf-8"))
    assert payload["missing_vmx_aliases"] == ["111"]
    assert payload["operation_boundaries"]["remote_write_performed"] is False