"""Static checks on deploy/agent-windows/gti-agent.ps1's `install-auto` command
(the zero-touch path driven by the enrollment bundle from the panel). No
Windows host is available in CI, so these are text-level guarantees — the
same properties are exercised for real in the manual Windows smoke test
described in docs/PILOT_DEPLOYMENT.md.
"""
import re
from pathlib import Path

SCRIPT = (Path(__file__).parents[2] / "deploy" / "agent-windows" / "gti-agent.ps1").read_text(encoding="utf-8")


def install_auto_block() -> str:
    start = SCRIPT.index("'install-auto' {")
    end = SCRIPT.index("'configure' {")
    return SCRIPT[start:end]


def test_install_auto_is_a_registered_command():
    validate_set = re.search(r"ValidateSet\(([^)]*)\)", SCRIPT).group(1)
    assert "'install-auto'" in validate_set


def test_install_auto_never_enables_firebird_writes():
    block = install_auto_block()
    assert "FIREBIRD_WRITES=0" in block
    assert "FIREBIRD_WRITES=1" not in SCRIPT  # nowhere in the whole script, not just this block


def test_install_auto_refuses_a_non_https_hub():
    assert "hub_url -notmatch '^https://'" in install_auto_block()


def test_install_auto_verifies_package_sha256_before_installing():
    block = install_auto_block()
    assert "SHA256_VALIDATION" in block and "Get-FileHash" in block
    assert block.index("SHA256_VALIDATION") < block.index("Invoke-RestMethod")  # integrity checked before any network call


def test_install_auto_deletes_the_enrollment_bundle_after_use():
    block = install_auto_block()
    assert "Remove-Item $EnrollmentFile -Force" in block
    assert block.index("Remove-Item $EnrollmentFile") > block.index("Invoke-RestMethod")  # only after a successful enroll


def test_install_auto_registers_but_never_starts_the_service():
    block = install_auto_block()
    assert "install" in block and "Start-Service" not in block  # Firebird config is still missing; starting it is a separate, explicit step


def test_install_auto_never_hardcodes_a_client_firebird_path():
    block = install_auto_block()
    assert "'FIREBIRD_DATABASE_PATH='" in block  # written, but as an empty placeholder (no real path baked in)


def test_install_auto_restricts_the_env_file_acl():
    block = install_auto_block()
    assert "icacls $EnvFile /inheritance:r /grant:r 'Administrators:(F)' 'SYSTEM:(F)'" in block


def test_install_auto_is_idempotent_when_already_enrolled():
    block = install_auto_block()
    assert "Already enrolled and installed" in block and "exit 0" in block