from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]


def test_edge_hsts_ownership_is_explicit_and_verified():
    settings = (ROOT / "backend/config/settings.py").read_text(encoding="utf-8")
    deploy = (ROOT / "scripts/deploy_production.sh").read_text(encoding="utf-8")
    workflow = (ROOT / ".gitea/workflows/deploy.yml").read_text(encoding="utf-8")
    example = (ROOT / ".env.production.example").read_text(encoding="utf-8")

    assert 'os.getenv("DJANGO_HSTS_AT_EDGE", "false")' in settings
    assert '["security.W004"]' in settings
    assert "DJANGO_HSTS_AT_EDGE=true" in workflow
    assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow
    assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy
    assert "DJANGO_HSTS_AT_EDGE=false" in example