"""Static contract: project must not force ad-hoc CODE_SIGN_IDENTITY when using Automatic Signing."""

from pathlib import Path
import re

REPO_ROOT = Path(__file__).resolve().parents[1]
PBX = REPO_ROOT / "native" / "ReynaCLIHost" / "ReynaCLIHost.xcodeproj" / "project.pbxproj"


def _read_pbx() -> str:
    assert PBX.exists(), f"project.pbxproj missing at {PBX}"
    return PBX.read_text()


def test_no_forced_adhoc_code_sign_identity():
    src = _read_pbx()
    # Fail if any CODE_SIGN_IDENTITY variant is forced to "-" or ad-hoc
    # Covers CODE_SIGN_IDENTITY and CODE_SIGN_IDENTITY[sdk=...]
    pattern = re.compile(r'CODE_SIGN_IDENTITY.*?=\s*"?-"?\s*;', re.IGNORECASE)
    matches = pattern.findall(src)
    assert not matches, f"found forced ad-hoc CODE_SIGN_IDENTITY: {matches} in {PBX}"

    # Also explicitly check literal '"-"'
    assert '"CODE_SIGN_IDENTITY[sdk=macosx*]" = "-"' not in src
    assert 'CODE_SIGN_IDENTITY = "-"' not in src
    assert 'CODE_SIGN_IDENTITY = -' not in src


def test_automatic_signing_not_paired_with_forced_identity():
    src = _read_pbx()
    # If project uses CODE_SIGN_STYLE = Automatic, it must not also force CODE_SIGN_IDENTITY to ad-hoc
    assert "CODE_SIGN_STYLE = Automatic" in src, "expected CODE_SIGN_STYLE=Automatic for durable identity"
    # Scan buildSettings blocks containing Automatic - simplistic but effective
    # Any occurrence of CODE_SIGN_IDENTITY with "-" while Automatic present is violation
    has_adhoc = bool(re.search(r'CODE_SIGN_IDENTITY.*=\s*"?-"?\s*;', src))
    has_auto = "CODE_SIGN_STYLE = Automatic" in src
    assert not (has_auto and has_adhoc), (
        "Automatic Signing paired with forced CODE_SIGN_IDENTITY=\"-\" defeats team signing; "
        "remove forced identity so Xcode can use selected team"
    )


def test_static_config_bundle_and_signing_style():
    src = _read_pbx()
    assert "com.reyna.cli.privacy-host" in src, "bundle ID must remain fixed"
    assert "CODE_SIGN_STYLE = Automatic" in src
    # Must not contain literal manual style when we expect automatic
    # Ensure bundle id still present and no ad-hoc marker left
    assert '"-" ' not in src or 'CODE_SIGN_IDENTITY' not in src.split('"-"')[0][-100:]  # sanity
    # Double-check no CODE_SIGN_IDENTITY forced at all (allow absence)
    assert 'CODE_SIGN_IDENTITY[sdk=' not in src or '"-"' not in src, "ad-hoc identity marker still present"