"""Padvalidatie: geen enkele door de gebruiker aangeleverde naam mag buiten
LIBRARY_DIR of de git-cache kunnen wijzen."""
import pytest

from conftest import login


@pytest.mark.parametrize("naam", [
    "vaultwarden", "app-1", "mijn_stack", "a.b-c", "X9",
])
def test_geldige_namen(env, naam):
    assert env["core"].safe_name(naam) == naam


@pytest.mark.parametrize("naam", [
    "", "..", ".", "../etc", "a/b", "/absoluut", "a\\b", "-begint-met-streepje",
    "met spatie", "nul\x00byte", "x" * 65, "a$b", "$(whoami)",
])
def test_ongeldige_namen(env, naam):
    assert env["core"].safe_name(naam) is None


def test_install_weigert_traversal_in_instance(client, env):
    csrf = login(client)
    r = client.post("/api/store/install",
                    json={"stack": "vaultwarden", "repo_id": "server-up",
                          "instance": "../../ontsnapt"},
                    headers={"X-CSRF-Token": csrf})
    assert r.status_code == 400
    assert not (env["tmp"] / "ontsnapt").exists()


def test_install_weigert_traversal_in_stack(client):
    csrf = login(client)
    r = client.post("/api/store/install",
                    json={"stack": "../../../etc", "repo_id": "server-up",
                          "instance": "test"},
                    headers={"X-CSRF-Token": csrf})
    assert r.get_json()["ok"] is False


def test_preview_weigert_traversal(client):
    csrf = login(client)
    r = client.post("/api/store/preview",
                    json={"stack": "../..", "repo_id": "server-up"},
                    headers={"X-CSRF-Token": csrf})
    assert r.get_json()["ok"] is False


@pytest.mark.parametrize("route", [
    "/api/stacks/{}/env", "/api/stacks/{}/compose", "/api/stacks/{}/logs",
])
def test_stackroutes_weigeren_ongeldige_naam(client, route):
    login(client)
    r = client.get(route.format(".."))
    assert r.status_code == 400


def test_stackactie_weigert_ongeldige_naam(client):
    csrf = login(client)
    r = client.post("/api/stacks/../start", headers={"X-CSRF-Token": csrf})
    # Werkzeug normaliseert '..' weg; wat er ook overblijft mag nooit 2xx zijn.
    assert r.status_code >= 400


def test_lege_stacknaam_raakt_de_library_zelf_niet(client, env):
    """`lib / ""` resolvet naar de library zelf — verwijderen zou alles wissen."""
    lib, d = _stack_dir(env, "")
    assert d is None


def _stack_dir(env, naam):
    import app as app_module
    with app_module.app.test_request_context():
        return app_module._stack_dir(naam)