"""Tests for :mod:`mgf.vm.core.security.isolation.checks.cpu_firmware` (MA-A2.6)."""

from __future__ import annotations

import xml.etree.ElementTree as ET

from mgf.vm.core.security.isolation.checks.cpu_firmware import (
    cpu_no_host_passthrough,
    cpu_no_topology_leak,
    firmware_uefi_secureboot,
)
from mgf.vm.core.security.isolation.context import AnalysisContext
from mgf.vm.core.security.isolation.types import IsolationCategory


def _ctx(domain_xml: str) -> AnalysisContext:
    return AnalysisContext(
        domain_xml=ET.ElementTree(ET.fromstring(domain_xml)),
        vm_name="t",
    )


_BASE = "<domain type='kvm'><name>t</name>{cpu}{os}<devices/></domain>"


class TestCpuNoHostPassthrough:
    def test_passes_for_host_model(self) -> None:
        xml = _BASE.format(cpu="<cpu mode='host-model'/>", os="<os/>")
        f = cpu_no_host_passthrough(_ctx(xml))
        assert f.passing is True
        assert f.category is IsolationCategory.ADVISORY

    def test_passes_when_no_cpu_element(self) -> None:
        xml = "<domain type='kvm'><name>t</name><devices/></domain>"
        f = cpu_no_host_passthrough(_ctx(xml))
        assert f.passing is True  # no cpu element ≠ host-passthrough

    def test_fails_for_host_passthrough(self) -> None:
        xml = _BASE.format(cpu="<cpu mode='host-passthrough'/>", os="<os/>")
        f = cpu_no_host_passthrough(_ctx(xml))
        assert f.passing is False
        assert f.fix_executor == "cpu.swap_to_host_model"


class TestFirmwareUefiSecureboot:
    def test_passes_for_modern_efi_attribute(self) -> None:
        xml = _BASE.format(cpu="", os="<os firmware='efi'><type>hvm</type></os>")
        f = firmware_uefi_secureboot(_ctx(xml))
        assert f.passing is True

    def test_passes_for_ovmf_loader_with_secure(self) -> None:
        xml = _BASE.format(
            cpu="",
            os=(
                "<os>"
                "<type>hvm</type>"
                "<loader readonly='yes' secure='yes' type='pflash'>"
                "/usr/share/OVMF/OVMF_CODE.secboot.fd"
                "</loader>"
                "</os>"
            ),
        )
        f = firmware_uefi_secureboot(_ctx(xml))
        assert f.passing is True

    def test_fails_for_bios(self) -> None:
        xml = _BASE.format(cpu="", os="<os><type>hvm</type></os>")
        f = firmware_uefi_secureboot(_ctx(xml))
        assert f.passing is False

    def test_fails_for_uefi_without_secureboot(self) -> None:
        xml = _BASE.format(
            cpu="",
            os=(
                "<os>"
                "<type>hvm</type>"
                "<loader readonly='yes' type='pflash'>"
                "/usr/share/OVMF/OVMF_CODE.fd"
                "</loader>"
                "</os>"
            ),
        )
        f = firmware_uefi_secureboot(_ctx(xml))
        assert f.passing is False


class TestCpuNoTopologyLeak:
    def test_passes_when_no_topology(self) -> None:
        xml = _BASE.format(cpu="<cpu mode='host-model'/>", os="<os/>")
        f = cpu_no_topology_leak(_ctx(xml))
        assert f.passing is True

    def test_fails_when_topology_present(self) -> None:
        xml = _BASE.format(
            cpu=("<cpu mode='host-model'><topology sockets='1' cores='4' threads='2'/></cpu>"),
            os="<os/>",
        )
        f = cpu_no_topology_leak(_ctx(xml))
        assert f.passing is False
        assert f.fix_executor == "cpu.generic_topology"
