"""Unit coverage for the fail-closed macOS rootless-Docker spike."""

from __future__ import annotations

import unittest
from pathlib import Path
from types import SimpleNamespace
from unittest.mock import patch

from bot_bottle.backend.macos_container import rootless_docker


class _Bottle:
    def __init__(self, results: list[SimpleNamespace]) -> None:
        self.results = results
        self.commands: list[str] = []

    def exec(self, command: str) -> SimpleNamespace:
        self.commands.append(command)
        return self.results.pop(0)


def _result(returncode: int, *, stdout: str = "", stderr: str = "") -> SimpleNamespace:
    return SimpleNamespace(returncode=returncode, stdout=stdout, stderr=stderr)


class TestRootlessDockerStart(unittest.TestCase):
    def test_bootstraps_then_waits_for_guest_local_daemon(self) -> None:
        bottle = _Bottle([_result(0), _result(1), _result(0)])
        with patch.object(rootless_docker.time, "sleep"):
            rootless_docker.start(bottle)
        self.assertIn("rootless-docker-init", bottle.commands[0])
        self.assertEqual(2, bottle.commands.count("docker info >/dev/null 2>&1"))

    def test_bootstrap_failure_is_fatal_without_privilege_fallback(self) -> None:
        bottle = _Bottle([_result(1, stderr="newuidmap missing")])
        with patch.object(rootless_docker, "die", side_effect=RuntimeError) as die:
            with self.assertRaises(RuntimeError):
                rootless_docker.start(bottle)
        self.assertIn("newuidmap missing", die.call_args.args[0])
        self.assertEqual(1, len(bottle.commands))

    def test_timeout_reports_guest_log(self) -> None:
        bottle = _Bottle(
            [_result(0)]
            + [_result(1) for _ in range(rootless_docker.READY_RETRIES)]
            + [_result(0, stdout="operation not permitted")]
        )
        with patch.object(rootless_docker.time, "sleep"), \
             patch.object(rootless_docker, "die", side_effect=RuntimeError) as die:
            with self.assertRaises(RuntimeError):
                rootless_docker.start(bottle)
        self.assertIn("operation not permitted", die.call_args.args[0])


class TestRootlessDockerImage(unittest.TestCase):
    def test_layers_tooling_without_changing_base_image(self) -> None:
        calls: list[tuple[str, str, str]] = []

        def build(image: str, context: str, *, dockerfile: str) -> None:
            calls.append((image, context, dockerfile))
            text = Path(dockerfile).read_text(encoding="utf-8")
            self.assertIn("FROM agent:base", text)
            self.assertIn("docker.io uidmap rootlesskit slirp4netns", text)
            self.assertIn("USER node", text)
            self.assertTrue((Path(context) / "rootless-docker-init.sh").is_file())

        image = rootless_docker.build_image("agent:base", build)
        self.assertEqual("agent:base-rootless-docker", image)
        self.assertEqual("agent:base-rootless-docker", calls[0][0])


if __name__ == "__main__":
    unittest.main()