"""Static URLs carry a version stamp, so nginx may cache them (PERF-006).

The audit asked for three lines of nginx: serve /static/ from disk with a
30-day expiry. Enabling that alone would have been a regression. The CSS and
the JS are referenced by a fixed URL, so a month-long cache means a
month-old stylesheet after every deploy, with no way to invalidate it short
of asking people to hard-refresh.

The stamp is what makes the caching safe: a changed file gets a new URL, and
the cached copy of the old one is simply never requested again. Delete the
stamp and the nginx block becomes a bug — which is the only reason these
tests exist.
"""

import os
import re

import pytest
from flask import url_for


@pytest.fixture
def nginx_conf():
    root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    with open(os.path.join(root, 'app', 'nginx.conf'), encoding='utf-8') as handle:
        return handle.read()


class TestVersionStamp:
    def test_static_urls_carry_a_stamp(self, app):
        with app.test_request_context():
            url = url_for('static', filename='css/style.css')

        assert re.search(r'\?v=\d+$', url), f'no cache-busting stamp in {url}'

    def test_a_touched_file_gets_a_new_url(self, app):
        """The whole point: redeploying a file must change its URL.

        The stamp is memoised per process — the process restarts on deploy,
        which is exactly when a file can have changed — so this drives a
        fresh application rather than touching the file under a live one.
        """
        from app.app import create_app

        path = os.path.join(app.static_folder, 'css/style.css')
        original = os.stat(path)

        with app.test_request_context():
            before = url_for('static', filename='css/style.css')

        os.utime(path, (original.st_atime, original.st_mtime + 60))
        try:
            second = create_app(dict(app.config))
            with second.test_request_context():
                after = url_for('static', filename='css/style.css')
        finally:
            os.utime(path, (original.st_atime, original.st_mtime))

        assert before != after

    def test_a_missing_file_still_builds_a_url(self, app):
        """A template naming a file that is not there must 404, not 500."""
        with app.test_request_context():
            url = url_for('static', filename='css/does-not-exist.css')

        assert url.endswith('does-not-exist.css'), 'no stamp, and no exception either'

    def test_other_endpoints_are_untouched(self, app):
        with app.test_request_context():
            assert '?v=' not in url_for('main.index')

    def test_the_stylesheet_and_the_script_are_versioned_in_the_page(self, client, app):
        """The stamp is worthless if the layout bypasses url_for."""
        page = client.get('/auth/login').get_data(as_text=True)

        assert re.search(r'style\.css\?v=\d+', page)
        assert re.search(r'main\.js\?v=\d+', page)


class TestNginx:
    def test_the_static_block_is_live(self, nginx_conf):
        block = re.search(r'^\s*location /static/ \{', nginx_conf, re.MULTILINE)
        assert block, 'the /static/ block is commented out again — 59 KB per page load'

    def test_caching_headers_are_present(self, nginx_conf):
        static_block = nginx_conf.split('location /static/')[1].split('\n        }')[0]

        assert 'expires 30d' in static_block
        assert 'immutable' in static_block

    def test_security_headers_survive_the_block(self, nginx_conf):
        """One add_header in a location drops every inherited one.

        nginx only inherits add_header from the enclosing block when the
        current block declares none of its own. Setting Cache-Control here
        therefore removes nosniff from the JavaScript unless it is repeated.
        """
        static_block = nginx_conf.split('location /static/')[1].split('\n        }')[0]

        assert 'X-Content-Type-Options' in static_block, (
            'add_header here cancels the inherited security headers; nosniff '
            'has to be repeated inside the block'
        )
        assert 'Strict-Transport-Security' in static_block