"""Static safety regression tests; run with python3 -m unittest discover -s tests."""
from pathlib import Path
import subprocess
import unittest
ROOT = Path(__file__).resolve().parents[1]
class ScannerTests(unittest.TestCase):
    @classmethod
    def setUpClass(cls):
        source = (ROOT / 'PHPGuard/SSHScanner.swift').read_text()
        cls.script = source.split('static let script = #"""',1)[1].split('"""#',1)[0]
    def test_posix_shell_syntax(self):
        p = subprocess.run(['sh','-n'],input=self.script,text=True,capture_output=True)
        self.assertEqual(p.returncode,0,p.stderr)
    def test_required_sections(self):
        for section in ('OS_RELEASE','PACKAGE_MANAGER','PACKAGES','PACKAGE_SOURCES','UPDATES','PACKAGE_ORIGINS','DOCKER','END'):
            self.assertIn('===%s===' % section,self.script)
    def test_supported_managers(self):
        for manager in ('apt','dnf','yum','rpm','zypper','apk'):
            self.assertIn(manager,self.script)
    def test_no_package_mutation(self):
        for command in ('apt upgrade','apt install','dnf update','yum update','apk upgrade','zypper update'):
            self.assertNotIn(command,self.script)
    def test_provenance_guard_is_not_hardcoded_false(self):
        code=(ROOT/'PHPGuard/VulnerabilityService.swift').read_text()
        self.assertNotIn('let hasUbuntuOrigin = false',code)
        self.assertIn('VERIFIED_INSTALLED_ORIGIN|ubuntu|',code)
        # Scanner does not issue an attestation from apt-cache policy alone.
        self.assertNotIn('VERIFIED_INSTALLED_ORIGIN|ubuntu|',self.script)
    def test_no_false_secure_claims(self):
        code=(ROOT/'PHPGuard/VulnerabilityService.swift').read_text()
        self.assertIn('Unverified',code)
    def test_icon_assets_are_assigned(self):
        import json
        directory=ROOT/'PHPGuard/Assets.xcassets/AppIcon.appiconset'
        metadata=json.loads((directory/'Contents.json').read_text())
        assigned={i.get('filename') for i in metadata['images']}
        unassigned={p.name for p in directory.glob('*.png')}-assigned
        self.assertFalse(unassigned,unassigned)
    def test_unknown_vendor_not_verified(self):
        store=(ROOT/'PHPGuard/AuditStore.swift').read_text()
        self.assertIn('No vendor advisory adapter for this distribution',store)
        self.assertIn('vendor-verified:',store)
if __name__=='__main__': unittest.main()