"""정적 COPY/source policy 회귀. 실제 Docker context 전송/build PASS를 대체하지 않는다."""
from pathlib import Path
import shlex
import unittest


ROOT = Path(__file__).resolve().parents[1]


class BuildContextTest(unittest.TestCase):
    def test_source_type_policy_and_sensitive_exclusions(self):
        rules = set(ROOT.joinpath('.dockerignore').read_text().splitlines())
        for rule in ('**', '!app/**/', '!app/**/*.py', '!app/**/*.tmpl', '!native/**/*.cpp',
                     '!native/**/*.h', '!native/**/*.hpp', '!native/**/*.cu', '!native/**/Makefile',
                     '!docker/requirements-*.txt', '!docker/constraints-*.txt',
                     '**/__pycache__/**', '**/build/**', '**/.env*', '**/*secret*',
                     '**/*credential*', '**/*.pth', '**/*.onnx', '**/*.plan', '**/*.mp4'):
            self.assertIn(rule, rules)
        self.assertNotIn('!app/**', rules)
        self.assertNotIn('!native/**', rules)

    def test_local_copy_inputs_exist_and_have_policy(self):
        dockerfile = ROOT.joinpath('docker/Dockerfile').read_text().replace('\\\n', ' ')
        rules = set(ROOT.joinpath('.dockerignore').read_text().splitlines())
        found = []
        for line in dockerfile.splitlines():
            tokens = shlex.split(line)
            if not tokens or tokens[0] != 'COPY' or any(t.startswith('--from=') for t in tokens):
                continue
            for source in tokens[1:-1]:
                if source.startswith('--'):
                    continue
                path = ROOT/source
                self.assertTrue(path.exists(), source)
                found.append(source)
                if path.is_dir():
                    prefix = source.split('/')[0]
                    self.assertIn('!'+prefix+'/', rules)
                    self.assertIn('!'+prefix+'/**/', rules)
                elif source.startswith('docker/requirements-'):
                    self.assertIn('!docker/requirements-*.txt', rules)
                elif source.startswith('docker/constraints-'):
                    self.assertIn('!docker/constraints-*.txt', rules)
                else:
                    self.assertIn('!'+source, rules)
        self.assertIn('app/', found)
        self.assertIn('native/frame_metadata/', found)