"""TS-10 — forbidden dangerous patterns MUST be absent from src/ (grep-pin; # noqa = reviewed)."""

from __future__ import annotations

import re
from pathlib import Path

_SRC = Path(__file__).resolve().parents[2] / "src" / "mgf" / "logship"
_FORBIDDEN = [
    (r"\beval\s*\(", "eval()"),
    (r"\bexec\s*\(", "exec()"),
    (r"shell\s*=\s*True", "subprocess shell=True"),
    (r"hashlib\.(md5|sha1)\s*\(", "weak hash"),
    (r"\bpickle\.loads?\s*\(", "pickle (untrusted deser)"),
    (r"verify\s*=\s*False", "TLS verify disabled"),
]


def test_no_forbidden_patterns_in_source() -> None:
    hits = []
    for py in _SRC.rglob("*.py"):
        for i, line in enumerate(py.read_text(encoding="utf-8").splitlines(), 1):
            if "# noqa" in line:
                continue
            for pat, reason in _FORBIDDEN:
                if re.search(pat, line):
                    hits.append(f"{py.name}:{i} — {reason}")
    assert not hits, "TS-10: forbidden patterns:\n  " + "\n  ".join(hits)
