"""Model tools trust the roots the daemon does: the kernel's OpenSSL reads
a bundle without the roots albedo_trust blocks, through SSL_CERT_FILE."""

import ast
import json
import unittest

from harness import Albedo, Provider, python, text

PROBE = (
    "import os, ssl\n"
    "path = os.environ.get('SSL_CERT_FILE', '')\n"
    "names = {dict(n[0] for n in c['subject']).get('commonName')\n"
    "         for c in ssl.create_default_context().get_ca_certs()}\n"
    "(path, len(names), sorted(names & {'emSign ECC Root CA - G3', 'AAA Certificate Services'}))"
)


def reply(request):
    if request["messages"][-1].get("role") == "user":
        return python(PROBE)
    return text("probed")


class TrustTests(unittest.TestCase):
    def test_kernel_openssl_reads_the_filtered_bundle(self):
        provider = Provider(reply)
        self.addCleanup(provider.close)
        with Albedo(provider) as app:
            session = app.session()
            app.prompt(session, "probe the trust store").close()
            app.idle(session)
            result = next(
                json.loads(part["value"])["value"]
                for entry in app.history(session)["items"]
                if entry["kind"] == "tool_result"
                for part in entry["content"]
                if part["kind"] == "json" and part["field"] == "result"
            )
            path, roots, blocked = ast.literal_eval(result)
            self.assertTrue(path.startswith(str(app.home / "cache")), path)
            self.assertGreater(roots, 0)
            self.assertEqual(blocked, [])


if __name__ == "__main__":
    unittest.main()