"""Static deployment contract for the Docker/Compose delivery."""

from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]


def test_dockerfile_uses_current_entrypoint_non_root_and_real_env_names():
    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")

    assert "COPY requirements.docker.txt" in dockerfile
    assert "USER auditprobe" in dockerfile
    assert "HITL_AUDIT_DB=/app/runtime/hitl/audit_log.db" in dockerfile
    assert "EVIDENCE_TRACING_ENABLED=true" in dockerfile
    assert "ENV EVIDENCE_TRACING=true" not in dockerfile
    assert 'CMD ["python", "-m", "streamlit", "run", "ui/professional_app.py"' in dockerfile
    assert "127.0.0.1:8501/_stcore/health" in dockerfile
    assert "ARG AUDITPROBE_VERSION=2.0.0" in dockerfile
    assert 'LABEL version="${AUDITPROBE_VERSION}"' in dockerfile


def test_compose_persists_hitl_and_does_not_embed_secrets():
    compose = (ROOT / "compose.yaml").read_text(encoding="utf-8")

    assert "auditprobe_hitl:/app/runtime/hitl" in compose
    assert "HITL_AUDIT_DB: /app/runtime/hitl/audit_log.db" in compose
    assert 'LLM_ASCEND_ENABLED: "false"' in compose
    assert "ATOMGIT_LLM_API_KEY" not in compose
    assert "MODELARTS_API_KEY" not in compose
    assert "MODELARTS_ENDPOINT" not in compose
    assert "your_atomgit_api_key" not in compose
    assert '${AUDITPROBE_VERSION:-2.0.0}' in compose


def test_docker_context_excludes_runtime_and_design_artifacts():
    ignored = (ROOT / ".dockerignore").read_text(encoding="utf-8")

    for required in (".env", "data/hitl_audit", "tests", "upload-zone-styleboard"):
        assert required in ignored


def test_streamlit_xsrf_protection_is_enabled():
    config = (ROOT / ".streamlit" / "config.toml").read_text(encoding="utf-8")

    assert "enableXsrfProtection = true" in config
    assert "enableXsrfProtection = false" not in config