"""Execute the dependency-free HUX browser foundation contract tests."""

from __future__ import annotations

import subprocess
from pathlib import Path

from hux_node_gate import require_node


ROOT = Path(__file__).resolve().parents[2]
NODE_TEST = ROOT / "testing/tests/test_hermes_hux_ui_foundation_node.js"
HUX_UI = ROOT / "dockerfiles/hermes-webui-hux"


def test_hux_ui_foundation_node_contracts():
    """The browser modules pass their functional and isolation checks."""
    require_node()

    result = subprocess.run(
        ["node", "--test", str(NODE_TEST)],
        cwd=ROOT,
        capture_output=True,
        check=False,
        text=True,
    )
    assert result.returncode == 0, result.stdout + result.stderr
    assert "fail 0" in result.stdout


def test_hux_ui_foundation_is_inert_and_bounded():
    """The foundation stays separate from the active image patch surface."""

    production = sorted(path for path in HUX_UI.iterdir() if path.suffix in {".js", ".css"})
    assert {path.name for path in production} == {
        "bootstrap.css",
        "bootstrap.js",
        "foundation.css",
        "foundation.js",
        "shell.js",
    }
    for path in production:
        assert len(path.read_text(encoding="utf-8").splitlines()) < 500

    dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
    # The WebUI image ships the HUX browser surface, but only from sources that
    # exist in this tree, and it never bakes activated HUX flags into the image:
    # the single HUX_FLAGS occurrence is the empty-flag build-time router check.
    copies = [
        line.split()[1]
        for line in dockerfile.splitlines()
        if line.startswith("COPY dockerfiles/hermes-webui-hux")
    ]
    assert copies
    for source in copies:
        assert (ROOT / source).is_file(), source
    assert dockerfile.count("HUX_FLAGS") == 1
    assert '"HUX_FLAGS": ""' in dockerfile


def test_hux_ui_foundation_never_persists_or_renders_raw_payloads():
    """Static guardrails forbid browser storage and raw-record display paths."""

    source = (HUX_UI / "foundation.js").read_text(encoding="utf-8")
    assert "localStorage" not in source
    assert "sessionStorage" not in source
    assert "innerHTML" not in source
    assert "record.detail" not in source
    assert "item.uri" not in source
    assert "item.hash" not in source
    assert "credentials: 'same-origin'" in source