"""Coverage tests for security/__init__.py ImportError fallback branches.

The missing statements are in try/except ImportError blocks:
- PathValidator import fails → PathValidator=None, _has_path_validator=False
- FileUploadValidator import fails → FileUploadValidator=None, _has_file_upload_validator=False
"""

import importlib
import sys
from unittest.mock import patch

import pytest


def _reload_security_with_blocked(blocked_submodule):
    """Reload security package with a submodule blocked via sys.modules[...]=None."""
    modules_to_remove = [
        k for k in sys.modules if "local_deep_research.security" in k
    ]
    saved = {k: sys.modules.pop(k) for k in modules_to_remove}

    try:
        with patch.dict(sys.modules, {blocked_submodule: None}):
            import local_deep_research.security as sec_mod

            importlib.reload(sec_mod)
            return sec_mod
    finally:
        sys.modules.update(saved)


@pytest.fixture(autouse=True)
def _restore_security_module():
    """Ensure security module is fully restored after each test."""
    yield
    # Force fresh re-import
    modules_to_remove = [
        k for k in list(sys.modules) if "local_deep_research.security" in k
    ]
    for k in modules_to_remove:
        sys.modules.pop(k, None)
    try:
        import local_deep_research.security

        importlib.reload(local_deep_research.security)
    except Exception:
        pass


class TestPathValidatorImportFallback:
    def test_path_validator_import_error(self):
        """When path_validator import fails, PathValidator is None."""
        sec = _reload_security_with_blocked(
            "local_deep_research.security.path_validator"
        )
        assert sec.PathValidator is None
        assert sec._has_path_validator is False


class TestFileUploadValidatorImportFallback:
    def test_file_upload_validator_import_error(self):
        """When file_upload_validator import fails, FileUploadValidator is None."""
        sec = _reload_security_with_blocked(
            "local_deep_research.security.file_upload_validator"
        )
        assert sec.FileUploadValidator is None
        assert sec._has_file_upload_validator is False
