atlas-iac/testing/tests/test_hermes_webui_hux_integration.py

"""Executable packaging gates for the inert Hermes HUX browser integration."""

from __future__ import annotations

import importlib.util
from pathlib import Path

from hux_node_gate import require_node, run_node_coverage
import shutil
import subprocess

import pytest


ROOT = Path(__file__).resolve().parents[2]
PATCHER = ROOT / "dockerfiles/hermes-webui-hux-patch.py"
BOOTSTRAP = ROOT / "dockerfiles/hermes-webui-hux/bootstrap.js"
BOOTSTRAP_STYLE = ROOT / "dockerfiles/hermes-webui-hux/bootstrap.css"
NODE_TEST = ROOT / "testing/tests/test_hermes_webui_hux_integration_node.js"

FIXTURE = ROOT / "testing/fixtures/hermes-webui-0.52.181"


def _load_patcher(name: str = "hermes_webui_hux_patch"):
    spec = importlib.util.spec_from_file_location(name, PATCHER)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    return module


def _fixture(tmp_path: Path, module) -> Path:
    target = tmp_path / "webui"
    shutil.copytree(FIXTURE, target)
    assets = target / "static/hux"
    for relative in (*module.STYLES, *module.SCRIPTS):
        path = target / "static" / relative
        path.parent.mkdir(parents=True, exist_ok=True)
        path.write_text("/* reviewed fixture */\n", encoding="utf-8")
    ui = target / "static/ui.js"
    ui.write_text("const S={session:null,messages:[]};\n", encoding="utf-8")
    (target / "static/boot.js").write_text(
        "async function cancelStream(){\n  let respOk=true; "
        "let respBody={ok:true,cancelled:false,stream_id:'owned'}; let streamId='owned';\n"
        "  return respOk;\n}\n\nasync function cancelSessionStream(){}\n", encoding="utf-8")
    (target / "static/messages.js").write_text(
        "async function send(){\n  const startData = postStartData || {};\n}\n",
        encoding="utf-8",
    )
    assert assets.is_dir()
    return target


def test_browser_bootstrap_per_source_line_and_branch_coverage() -> None:
    run_node_coverage(
        [
            "dockerfiles/hermes-webui-hux/bootstrap.js",
        ],
        [
            "testing/tests/test_hermes_webui_hux_integration_node.js",
        ],
        {"branches": 95, "functions": 95, "lines": 95},
        strip_types=False,
    )


def test_patcher_installs_all_assets_atomically_and_rejects_drift(tmp_path: Path) -> None:
    require_node()
    module = _load_patcher()
    target = _fixture(tmp_path, module)
    module.apply(target)
    index = (target / "static/index.html").read_text(encoding="utf-8")
    worker = (target / "static/sw.js").read_text(encoding="utf-8")
    boot = (target / "static/boot.js").read_text(encoding="utf-8")
    messages = (target / "static/messages.js").read_text(encoding="utf-8")
    for relative in module.STYLES:
        assert index.count(f"static/{relative}?v=__WEBUI_VERSION__") == 1
        assert worker.count(f"'./static/{relative}' + VQ") == 1
    for relative in module.SCRIPTS:
        assert index.count(f"static/{relative}?v=__WEBUI_VERSION__") == 1
        assert worker.count(f"'./static/{relative}' + VQ") == 1
    assert "respBody.cancelled===true" in boot and "respBody.stream_id===streamId" in boot
    assert "HermesHuxBootstrap.mergeTrustedContext(S.session, startData)" in messages
    result = subprocess.run(["node", "-e", boot + "\ncancelStream().then(console.log)"],
                            check=True, capture_output=True, text=True)
    assert result.stdout.strip() == "false", "a 2xx already-inactive response is not a cancellation"
    with pytest.raises(SystemExit, match="already installed"):
        module.apply(target)

    drift = _fixture(tmp_path / "drift", module)
    worker_path = drift / "static/sw.js"
    worker_path.write_text(worker_path.read_text().replace("./static/style.css", "./static/base.css"))
    before = (drift / "static/index.html").read_bytes()
    with pytest.raises(SystemExit, match="service-worker patch context changed"):
        module.apply(drift)
    assert (drift / "static/index.html").read_bytes() == before


def test_docker_jenkins_and_smoke_own_the_exact_inert_bundle() -> None:
    dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
    jenkins = (ROOT / "ci/Jenkinsfile.hermes-webui-image").read_text(encoding="utf-8")
    smoke = (ROOT / "dockerfiles/hermes-webui-smoke.py").read_text(encoding="utf-8")
    assert "COPY dockerfiles/hermes-webui-hux-patch.py" in dockerfile
    assert "python /tmp/hermes-webui-hux-patch.py" in dockerfile
    assert "COPY dockerfiles/hermes-webui-hux-bff-patch.py" in dockerfile
    assert "python /tmp/hermes-webui-hux-bff-patch.py" in dockerfile
    assert "COPY services/hermes/contracts/hux /opt/hermes-hux/contracts" in dockerfile
    assert "HUX_CONTRACT_DIR=/opt/hermes-hux/contracts" in dockerfile
    assert "test -f /opt/hermes-hux/contracts/release-ledger.schema.json" in dockerfile
    assert "static/hux/bootstrap.js" in dockerfile
    assert "api/hux_bff.py" in dockerfile
    assert "test_hermes_webui_hux_integration.py" in jenkins
    assert "test_hermes_webui_hux_bff.py" in jenkins
    assert "HUX_LINKS" in smoke


def test_bootstrap_is_bounded_dependency_free_and_has_no_browser_persistence() -> None:
    source = BOOTSTRAP.read_text(encoding="utf-8")
    style = BOOTSTRAP_STYLE.read_text(encoding="utf-8")
    for path in (PATCHER, BOOTSTRAP, BOOTSTRAP_STYLE, NODE_TEST, Path(__file__)):
        assert len(path.read_text(encoding="utf-8").splitlines()) <= 500
    lowered = source.lower()
    for forbidden in ("localstorage", "sessionstorage", "indexeddb", "document.cookie",
                      "location.href", "location.pathname", "innerhtml", "react"):
        assert forbidden not in lowered
    assert "S.session" in source
    assert "value.hux_context" in source
    assert "status === 404" in source
    assert "current !== generation" in source
    assert "prefers-reduced-motion" in style
    assert "focus-visible" in style