"""Tests for the Infomaniak/Magogi domain defaults (DESIGN §6)."""

from __future__ import annotations

from mgf.cloud import defaults


def test_endpoint_and_placement_constants() -> None:
    assert defaults.AUTH_URL.startswith("https://")
    assert defaults.REGION == "dc3-a"
    assert defaults.DEFAULT_NETWORK == "ext-net1"
    # The floating-IP pool MUST be distinct from the instance network — allocating
    # a floating IP from ext-net1 is a 400 "not a valid external network".
    assert defaults.DEFAULT_FLOATING_NETWORK != defaults.DEFAULT_NETWORK


def test_default_ingress_rules_cover_the_standard_ports() -> None:
    rules = defaults.default_ingress_rules()
    ports = {r.port_min for r in rules}
    assert ports == set(defaults.DEFAULT_INGRESS_PORTS)
    assert all(r.direction == "ingress" and r.protocol == "tcp" for r in rules)


def test_cloud_init_is_hardened() -> None:
    body = defaults.DEFAULT_CLOUD_INIT
    assert "ssh_pwauth: false" in body
    assert "disable_root: true" in body
