"""SC-04 — .gates state files are mode 0o600 + atomic; SC-15 — failure-bundle
filenames can't escape the failures/ dir (path-traversal guard)."""

from __future__ import annotations

import stat

from mgf.test_supervisor.quarantine import QuarantineStore
from mgf.test_supervisor.records import now_iso
from mgf.test_supervisor.supervisor import _safe_filename


def test_quarantine_file_is_0o600(tmp_path) -> None:
    p = tmp_path / "quarantine.json"
    s = QuarantineStore(p)
    s.update_outcome("t::x", "failed", "boom", now_iso())
    s.save()
    assert stat.S_IMODE(p.stat().st_mode) == 0o600, "SC-04: state file must be owner-only (0o600)"


def test_safe_filename_strips_path_separators() -> None:
    # SC-15: no path separator may survive sanitisation — a traversal-shaped
    # test_id collapses to a single flat basename (no `/`, no escape).
    for evil in ("../../etc/passwd", "/abs/path::test", "a/b/c::test_x", "..\\..\\win"):
        safe = _safe_filename(evil)
        assert "/" not in safe and "\\" not in safe
        # the bundle path stays inside failures/
        assert (".." + "/") not in (safe + "/")
