"""Test mask_fwupd_passim — keep fwupd's LAN metadata daemon off.

fwupd pulls in passim, a daemon that shares firmware metadata with other
machines on the LAN by listening publicly on 0.0.0.0:27500. Any fwupdmgr
run D-Bus-activates it, and because the unit is static (no [Install]
section) `systemctl disable` is a no-op: it came back on velox the next
time fwupdmgr ran (2026-09-12). Masking is what holds, and it is how
ratio has carried it since 2026-07-21.

Method: sed-extract mask_fwupd_passim from the real `archsetup`; fake
run_task (minus error_warn, so the failure test sees the function's own
return path) and systemctl, and assert on the call.

    python3 -m unittest tests.installer-steps.test_mask_fwupd_passim
"""

import os
import re
import subprocess
import textwrap
import unittest

REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
ARCHSETUP = os.path.join(REPO_ROOT, "archsetup")


def run(systemctl_body='echo "SYSTEMCTL: $*";'):
    script = textwrap.dedent(f"""\
        logfile=/dev/null
        action=""
        display() {{ :; }}
        run_task() {{ echo "TASK: $1"; shift; "$@"; }}
        systemctl() {{ {systemctl_body} }}
        error_warn() {{ echo "WARN: $1"; return 1; }}
        source <(sed -n '/^mask_fwupd_passim() {{/,/^}}/p' "{ARCHSETUP}")
        mask_fwupd_passim
        echo "RC=$?"
        exit 0
    """)
    return subprocess.run(
        ["bash", "-c", script], capture_output=True, text=True, timeout=10,
    )


def rc_of(r):
    m = re.search(r"^RC=(\d+)$", r.stdout, re.M)
    assert m, "no RC line in output: %r / %r" % (r.stdout, r.stderr)
    return int(m.group(1))


class MaskFwupdPassim(unittest.TestCase):
    # ------------------------------------------------------------ normal ----
    def test_masks_the_passim_unit(self):
        r = run()
        self.assertIn("SYSTEMCTL: mask passim.service", r.stdout)
        self.assertEqual(rc_of(r), 0)

    def test_masks_rather_than_disables(self):
        # disable is a no-op on a static unit and is the mistake this step
        # exists to avoid; a mask is the only call that sticks.
        r = run()
        calls = [l for l in r.stdout.splitlines() if l.startswith("SYSTEMCTL:")]
        self.assertEqual(calls, ["SYSTEMCTL: mask passim.service"])

    # ---------------------------------------------------------- boundary ----
    # Re-running is idempotent because `systemctl mask` on an already-masked
    # unit exits 0 and changes nothing; that property lives in systemctl, so
    # there is no stateless test here that could tell it apart from a pass.

    # ------------------------------------------------------------- error ----
    def test_failed_mask_reports_nonzero(self):
        # The fake run_task returns the command's status without the real
        # error_warn wiring, so this checks the function's own return path.
        r = run(systemctl_body='echo "SYSTEMCTL: $*"; return 1;')
        self.assertNotEqual(rc_of(r), 0)


if __name__ == "__main__":
    unittest.main()