#!/usr/bin/env python3

import unittest
from pathlib import Path


PROJECT_ROOT = Path(__file__).resolve().parents[1]
SERVICE = (
    PROJECT_ROOT
    / "deploy"
    / "systemd"
    / "system"
    / "jwebot-extension-host@.service"
)
SOCKET = (
    PROJECT_ROOT
    / "deploy"
    / "systemd"
    / "system"
    / "jwebot-extension-host@.socket"
)


class ExtensionSandboxUnitTests(unittest.TestCase):
    def test_service_has_required_isolation_controls(self):
        text = SERVICE.read_text(encoding="utf-8")
        for setting in (
            "User=jwebot-ext",
            "NoNewPrivileges=true",
            "CapabilityBoundingSet=",
            "PrivateNetwork=true",
            "ProtectSystem=strict",
            "ProtectHome=true",
            "MemoryDenyWriteExecute=true",
            "RestrictAddressFamilies=AF_UNIX",
            "RuntimeMaxSec=12s",
            "MemoryMax=128M",
            "TasksMax=16",
            "LimitCORE=0",
        ):
            with self.subTest(setting=setting):
                self.assertIn(setting, text)

    def test_socket_is_private_to_the_edge_user(self):
        text = SOCKET.read_text(encoding="utf-8")
        self.assertIn("SocketUser=jwebot", text)
        self.assertIn("SocketMode=0600", text)
        self.assertIn("RemoveOnStop=true", text)

    def test_service_has_no_write_allowlist(self):
        text = SERVICE.read_text(encoding="utf-8")
        self.assertNotIn("ReadWritePaths=", text)
        self.assertIn("ReadOnlyPaths=/var/lib/jwebot-extensions/%i", text)


if __name__ == "__main__":
    unittest.main()