"""Tests for :mod:`mgf.vm.core.security.isolation.checks.memory` and
:mod:`mgf.vm.core.security.isolation.checks.devices` (MA-A2.7)."""

from __future__ import annotations

from _isolation_xml import domain_with, parsed

from mgf.vm.core.security.isolation.checks.devices import (
    device_no_tpm_passthrough,
    device_no_vhost_vsock,
    device_vhost_net_disabled,
)
from mgf.vm.core.security.isolation.checks.memory import memory_no_balloon
from mgf.vm.core.security.isolation.context import AnalysisContext
from mgf.vm.core.security.isolation.types import FixKind, IsolationCategory


def _ctx(*body: str) -> AnalysisContext:
    return AnalysisContext(
        domain_xml=parsed(domain_with(*body)),
        vm_name="t",
    )


# ---------------------------------------------------------------------------
# memory.no_balloon
# ---------------------------------------------------------------------------


class TestMemoryNoBalloon:
    def test_passes_when_no_balloon(self) -> None:
        f = memory_no_balloon(_ctx())
        assert f.passing is True

    def test_passes_when_balloon_none(self) -> None:
        f = memory_no_balloon(_ctx("<memballoon model='none'/>"))
        assert f.passing is True
        assert f.category is IsolationCategory.ADVISORY

    def test_fails_when_balloon_virtio(self) -> None:
        f = memory_no_balloon(_ctx("<memballoon model='virtio'/>"))
        assert f.passing is False
        assert f.fix_kind is FixKind.AUTO_FIX
        assert f.fix_executor == "memory.add_balloon_none"


# ---------------------------------------------------------------------------
# device.no_tpm_passthrough
# ---------------------------------------------------------------------------


class TestDeviceNoTpmPassthrough:
    def test_passes_when_no_tpm(self) -> None:
        f = device_no_tpm_passthrough(_ctx())
        assert f.passing is True

    def test_passes_when_emulated_tpm(self) -> None:
        body = "<tpm model='tpm-tis'><backend type='emulator' version='2.0'/></tpm>"
        f = device_no_tpm_passthrough(_ctx(body))
        assert f.passing is True

    def test_fails_when_tpm_passthrough(self) -> None:
        body = (
            "<tpm model='tpm-tis'>"
            "<backend type='passthrough'><device path='/dev/tpm0'/></backend>"
            "</tpm>"
        )
        f = device_no_tpm_passthrough(_ctx(body))
        assert f.passing is False
        assert f.fix_executor == "device.strip_tpm_passthrough"


# ---------------------------------------------------------------------------
# device.no_vhost_vsock
# ---------------------------------------------------------------------------


class TestDeviceNoVhostVsock:
    def test_passes_when_no_vsock(self) -> None:
        f = device_no_vhost_vsock(_ctx())
        assert f.passing is True

    def test_fails_when_vsock_present(self) -> None:
        body = "<vsock model='virtio'><cid auto='yes'/></vsock>"
        f = device_no_vhost_vsock(_ctx(body))
        assert f.passing is False
        assert f.fix_executor == "strip.vsock"


# ---------------------------------------------------------------------------
# device.vhost_net_disabled
# ---------------------------------------------------------------------------


class TestDeviceVhostNetDisabled:
    def test_passes_when_no_interfaces(self) -> None:
        f = device_vhost_net_disabled(_ctx())
        assert f.passing is True

    def test_passes_when_qemu_driver(self) -> None:
        body = (
            "<interface type='network'>"
            "<source network='vmanager-quarantine'/>"
            "<model type='virtio'/>"
            "<driver name='qemu'/>"
            "</interface>"
        )
        f = device_vhost_net_disabled(_ctx(body))
        assert f.passing is True

    def test_passes_when_no_driver_attribute(self) -> None:
        # Default qemu/libvirt driver != vhost.
        body = (
            "<interface type='network'>"
            "<source network='vmanager-quarantine'/>"
            "<model type='virtio'/>"
            "</interface>"
        )
        f = device_vhost_net_disabled(_ctx(body))
        assert f.passing is True

    def test_fails_when_vhost_driver(self) -> None:
        body = (
            "<interface type='network'>"
            "<source network='vmanager-quarantine'/>"
            "<model type='virtio'/>"
            "<driver name='vhost'/>"
            "<alias name='net0'/>"
            "</interface>"
        )
        f = device_vhost_net_disabled(_ctx(body))
        assert f.passing is False
        assert f.fix_executor == "device.swap_vhost_to_qemu"
