LEDMatrix/test/test_backup_manager.py

"""Tests for src.backup_manager."""

from __future__ import annotations

import json
import os
import stat
import sys
import zipfile
from pathlib import Path
from unittest.mock import MagicMock

import pytest

from src import backup_manager
from src.backup_manager import (
    BUNDLED_FONTS,
    SCHEMA_VERSION,
    RestoreOptions,
    create_backup,
    list_installed_plugins,
    preview_backup_contents,
    restore_backup,
    validate_backup,
)


# ---------------------------------------------------------------------------
# Fixtures
# ---------------------------------------------------------------------------


def _make_project(root: Path) -> Path:
    """Build a minimal fake project tree under ``root``."""
    (root / "config").mkdir(parents=True)
    (root / "config" / "config.json").write_text(
        json.dumps({"web_ui": {"port": 8080}, "my-plugin": {"enabled": True, "favorites": ["A", "B"]}}),
        encoding="utf-8",
    )
    (root / "config" / "config_secrets.json").write_text(
        json.dumps({"ledmatrix-weather": {"api_key": "SECRET"}}),
        encoding="utf-8",
    )
    (root / "config" / "wifi_config.json").write_text(
        json.dumps({"ap_mode": {"ssid": "LEDMatrix"}}),
        encoding="utf-8",
    )
    # Device-local auth that lives in config/ like the three above. It was
    # omitted from backups, so a restore silently signed the user out of
    # YouTube Music and they had to re-authenticate by hand.
    (root / "config" / "ytm_auth.json").write_text(
        json.dumps({"token": "YTM-TOKEN"}),
        encoding="utf-8",
    )

    fonts = root / "assets" / "fonts"
    fonts.mkdir(parents=True)
    # One bundled font (should be excluded) and one user-uploaded font.
    (fonts / "5x7.bdf").write_text("BUNDLED", encoding="utf-8")
    (fonts / "my-custom-font.ttf").write_bytes(b"\x00\x01USER")

    uploads = root / "assets" / "plugins" / "static-image" / "uploads"
    uploads.mkdir(parents=True)
    (uploads / "image_1.png").write_bytes(b"\x89PNG\r\n\x1a\nfake")
    (uploads / ".metadata.json").write_text(json.dumps({"a": 1}), encoding="utf-8")

    # plugin-repos for installed-plugin enumeration.
    plugin_dir = root / "plugin-repos" / "my-plugin"
    plugin_dir.mkdir(parents=True)
    (plugin_dir / "manifest.json").write_text(
        json.dumps({"id": "my-plugin", "version": "1.2.3"}),
        encoding="utf-8",
    )

    # plugin_state.json
    (root / "data").mkdir()
    (root / "data" / "plugin_state.json").write_text(
        json.dumps(
            {
                "version": 1,
                "states": {
                    "my-plugin": {"version": "1.2.3", "enabled": True},
                    "other-plugin": {"version": "0.1.0", "enabled": False},
                },
            }
        ),
        encoding="utf-8",
    )
    return root


@pytest.fixture
def project(tmp_path: Path) -> Path:
    return _make_project(tmp_path / "src_project")


@pytest.fixture
def empty_project(tmp_path: Path) -> Path:
    root = tmp_path / "dst_project"
    root.mkdir()
    # Pre-seed only the bundled font to simulate a fresh install.
    (root / "assets" / "fonts").mkdir(parents=True)
    (root / "assets" / "fonts" / "5x7.bdf").write_text("BUNDLED", encoding="utf-8")
    return root


# ---------------------------------------------------------------------------
# BUNDLED_FONTS sanity
# ---------------------------------------------------------------------------


def test_bundled_fonts_matches_repo() -> None:
    """Every entry in BUNDLED_FONTS must exist on disk in assets/fonts/.

    The reverse direction is intentionally not checked: real installations
    have user-uploaded fonts in the same directory, and they should be
    treated as user data (not bundled).
    """
    repo_fonts = Path(__file__).resolve().parent.parent / "assets" / "fonts"
    if not repo_fonts.exists():
        pytest.skip("assets/fonts not present in test env")
    on_disk = {p.name for p in repo_fonts.iterdir() if p.is_file()}
    missing = set(BUNDLED_FONTS) - on_disk
    assert not missing, f"BUNDLED_FONTS references files not in assets/fonts/: {missing}"


# ---------------------------------------------------------------------------
# Preview / enumeration
# ---------------------------------------------------------------------------


def test_list_installed_plugins(project: Path) -> None:
    plugins = list_installed_plugins(project)
    ids = [p["plugin_id"] for p in plugins]
    assert "my-plugin" in ids
    assert "other-plugin" in ids
    my = next(p for p in plugins if p["plugin_id"] == "my-plugin")
    assert my["version"] == "1.2.3"


def test_preview_backup_contents(project: Path) -> None:
    preview = preview_backup_contents(project)
    assert preview["has_config"] is True
    assert preview["has_secrets"] is True
    assert preview["has_wifi"] is True
    assert preview["user_fonts"] == ["my-custom-font.ttf"]
    assert preview["plugin_uploads"] >= 2
    assert any(p["plugin_id"] == "my-plugin" for p in preview["plugins"])


# ---------------------------------------------------------------------------
# Export
# ---------------------------------------------------------------------------


def test_create_backup_contents(project: Path, tmp_path: Path) -> None:
    out_dir = tmp_path / "exports"
    zip_path = create_backup(project, output_dir=out_dir)
    assert zip_path.exists()
    assert zip_path.parent == out_dir
    with zipfile.ZipFile(zip_path) as zf:
        names = set(zf.namelist())
    assert "manifest.json" in names
    assert "config/config.json" in names
    assert "config/config_secrets.json" in names
    assert "config/wifi_config.json" in names
    assert "assets/fonts/my-custom-font.ttf" in names
    # Bundled font must NOT be included.
    assert "assets/fonts/5x7.bdf" not in names
    assert "assets/plugins/static-image/uploads/image_1.png" in names
    assert "plugins.json" in names


def test_create_backup_manifest(project: Path, tmp_path: Path) -> None:
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    with zipfile.ZipFile(zip_path) as zf:
        manifest = json.loads(zf.read("manifest.json"))
    assert manifest["schema_version"] == backup_manager.SCHEMA_VERSION
    assert "created_at" in manifest
    assert set(manifest["contents"]) >= {"config", "secrets", "wifi", "fonts", "plugin_uploads", "plugins"}


def test_manifest_version_is_the_core_release(project: Path, tmp_path: Path) -> None:
    """Not a git sha or a truncated "ref: refs/he..." read from .git/HEAD."""
    from src import __version__
    git = project / ".git"
    git.mkdir()
    (git / "HEAD").write_text("ref: refs/heads/some-branch-that-is-not-there\n", encoding="utf-8")
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    with zipfile.ZipFile(zip_path) as zf:
        manifest = json.loads(zf.read("manifest.json"))
    assert manifest["ledmatrix_version"] == __version__


def test_installed_plugins_come_from_the_configured_directory(tmp_path: Path) -> None:
    root = tmp_path / "proj"
    (root / "config").mkdir(parents=True)
    (root / "config" / "config.json").write_text(
        json.dumps({"plugin_system": {"plugins_directory": "plugins"}}), encoding="utf-8")
    plugin_dir = root / "plugins" / "dev-plugin"
    plugin_dir.mkdir(parents=True)
    (plugin_dir / "manifest.json").write_text(
        json.dumps({"id": "dev-plugin", "version": "0.3.0"}), encoding="utf-8")

    assert [p["plugin_id"] for p in list_installed_plugins(root)] == ["dev-plugin"]


# ---------------------------------------------------------------------------
# Validate
# ---------------------------------------------------------------------------


def test_validate_backup_ok(project: Path, tmp_path: Path) -> None:
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    ok, err, manifest = validate_backup(zip_path)
    assert ok, err
    assert err == ""
    assert "config" in manifest["detected_contents"]
    assert "secrets" in manifest["detected_contents"]
    assert any(p["plugin_id"] == "my-plugin" for p in manifest["plugins"])


def test_validate_backup_missing_manifest(tmp_path: Path) -> None:
    zip_path = tmp_path / "bad.zip"
    with zipfile.ZipFile(zip_path, "w") as zf:
        zf.writestr("config/config.json", "{}")
    ok, err, _ = validate_backup(zip_path)
    assert not ok
    assert "manifest" in err.lower()


def test_validate_backup_bad_schema_version(tmp_path: Path) -> None:
    zip_path = tmp_path / "bad.zip"
    with zipfile.ZipFile(zip_path, "w") as zf:
        zf.writestr("manifest.json", json.dumps({"schema_version": 999}))
    ok, err, _ = validate_backup(zip_path)
    assert not ok
    assert "schema" in err.lower()


def test_validate_backup_rejects_zip_traversal(tmp_path: Path) -> None:
    zip_path = tmp_path / "malicious.zip"
    with zipfile.ZipFile(zip_path, "w") as zf:
        zf.writestr("manifest.json", json.dumps({"schema_version": SCHEMA_VERSION, "contents": []}))
        zf.writestr("../../etc/passwd", "x")
    ok, err, _ = validate_backup(zip_path)
    assert not ok
    assert "unsafe" in err.lower()


def test_validate_backup_not_a_zip(tmp_path: Path) -> None:
    p = tmp_path / "nope.zip"
    p.write_text("hello", encoding="utf-8")
    ok, _err, _ = validate_backup(p)
    assert not ok


# ---------------------------------------------------------------------------
# Restore
# ---------------------------------------------------------------------------


def test_restore_roundtrip(project: Path, empty_project: Path, tmp_path: Path) -> None:
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    result = restore_backup(zip_path, empty_project, RestoreOptions())

    assert result.success, result.errors
    assert "config" in result.restored
    assert "secrets" in result.restored
    assert "wifi" in result.restored

    # Files exist with correct contents.
    restored_config = json.loads((empty_project / "config" / "config.json").read_text())
    assert restored_config["my-plugin"]["favorites"] == ["A", "B"]

    restored_secrets = json.loads((empty_project / "config" / "config_secrets.json").read_text())
    assert restored_secrets["ledmatrix-weather"]["api_key"] == "SECRET"

    assert "ytm_auth" in result.restored
    restored_ytm = json.loads((empty_project / "config" / "ytm_auth.json").read_text())
    assert restored_ytm["token"] == "YTM-TOKEN"

    # User font restored, bundled font untouched.
    assert (empty_project / "assets" / "fonts" / "my-custom-font.ttf").read_bytes() == b"\x00\x01USER"
    assert (empty_project / "assets" / "fonts" / "5x7.bdf").read_text() == "BUNDLED"

    # Plugin uploads restored.
    assert (empty_project / "assets" / "plugins" / "static-image" / "uploads" / "image_1.png").exists()

    # Plugins to install surfaced for the caller.
    plugin_ids = {p["plugin_id"] for p in result.plugins_to_install}
    assert "my-plugin" in plugin_ids


def test_restore_honors_options(project: Path, empty_project: Path, tmp_path: Path) -> None:
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    opts = RestoreOptions(
        restore_config=True,
        restore_secrets=False,
        restore_wifi=False,
        restore_fonts=False,
        restore_plugin_uploads=False,
        reinstall_plugins=False,
    )
    result = restore_backup(zip_path, empty_project, opts)
    assert result.success, result.errors
    assert (empty_project / "config" / "config.json").exists()
    assert not (empty_project / "config" / "config_secrets.json").exists()
    assert not (empty_project / "config" / "wifi_config.json").exists()
    assert not (empty_project / "assets" / "fonts" / "my-custom-font.ttf").exists()
    assert result.plugins_to_install == []
    assert "secrets" in result.skipped
    assert "wifi" in result.skipped
    # ytm_auth rides on restore_wifi rather than its own flag -- disabling
    # wifi restore must not leave a stale session token behind.
    assert "ytm_auth" in result.skipped
    assert not (empty_project / "config" / "ytm_auth.json").exists()


def test_restore_rejects_malicious_zip(empty_project: Path, tmp_path: Path) -> None:
    zip_path = tmp_path / "bad.zip"
    with zipfile.ZipFile(zip_path, "w") as zf:
        zf.writestr("manifest.json", json.dumps({"schema_version": SCHEMA_VERSION, "contents": []}))
        zf.writestr("../escape.txt", "x")
    result = restore_backup(zip_path, empty_project, RestoreOptions())
    # validate_backup catches it before extraction.
    assert not result.success
    assert any("unsafe" in e.lower() for e in result.errors)


@pytest.mark.skipif(
    sys.platform == "win32",
    reason="simulates root-owned POSIX files with chmod 0o444, which on Windows sets the "
    "read-only attribute, and Windows refuses to rename over a read-only file",
)
def test_restore_over_a_file_the_user_cannot_write(
    project: Path, empty_project: Path, tmp_path: Path
) -> None:
    """Restore must not need write permission on the destination *file*.

    Reproduces what a fresh install leaves behind: config files owned by root
    and only group-readable, while the web interface that performs the restore
    runs as a non-root user. shutil.copy2 opens the destination for writing and
    failed with EACCES; writing alongside and renaming needs only directory
    permission, which that account has.

    Simulated here by making the destination read-only — the owner cannot
    open it for writing either, but can still replace it within its directory.
    """
    zip_path = create_backup(project, output_dir=tmp_path / "exports")

    # Pre-existing, read-only destinations.
    (empty_project / "config").mkdir(parents=True, exist_ok=True)
    for name in ("config.json", "config_secrets.json", "wifi_config.json", "ytm_auth.json"):
        target = empty_project / "config" / name
        target.write_text("{}", encoding="utf-8")
        target.chmod(0o444)

    result = restore_backup(zip_path, empty_project, RestoreOptions())

    assert result.success, result.errors
    for section in ("config", "secrets", "wifi", "ytm_auth"):
        assert section in result.restored, f"{section} not restored: {result.errors}"

    restored = json.loads((empty_project / "config" / "config.json").read_text())
    assert restored["my-plugin"]["favorites"] == ["A", "B"]

    # The destination's mode is preserved rather than widened to the umask.
    assert stat.S_IMODE((empty_project / "config" / "config_secrets.json").stat().st_mode) == 0o444


def _existing_config(empty_project: Path) -> None:
    (empty_project / "config").mkdir(parents=True, exist_ok=True)
    for name in ("config.json", "config_secrets.json", "wifi_config.json", "ytm_auth.json"):
        (empty_project / "config" / name).write_text("{}", encoding="utf-8")


def test_restore_over_existing_files_without_os_chown(
    project: Path, empty_project: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
) -> None:
    """Restore must work where the OS has no file ownership API (Windows).

    Replacing a file tries to carry its previous owner across with os.chown.
    That name does not exist on Windows, and the AttributeError is not an
    OSError, so it escaped every per-section handler: restoring over any
    existing config aborted the whole restore and left the old files in place.
    """
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    _existing_config(empty_project)
    monkeypatch.delattr(os, "chown", raising=False)

    result = restore_backup(zip_path, empty_project, RestoreOptions())

    assert result.success, result.errors
    for section in ("config", "secrets", "wifi", "ytm_auth"):
        assert section in result.restored, f"{section} not restored: {result.errors}"
    restored = json.loads((empty_project / "config" / "config.json").read_text())
    assert restored["my-plugin"]["favorites"] == ["A", "B"]


def test_restore_still_carries_the_previous_owner_across(
    project: Path, empty_project: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
) -> None:
    """Where os.chown exists, the replaced file keeps the old file's owner."""
    zip_path = create_backup(project, output_dir=tmp_path / "exports")
    _existing_config(empty_project)
    target = empty_project / "config" / "config.json"
    old = target.stat()
    chown = MagicMock()
    monkeypatch.setattr(os, "chown", chown, raising=False)

    result = restore_backup(zip_path, empty_project, RestoreOptions(
        restore_secrets=False, restore_wifi=False,
        restore_fonts=False, restore_plugin_uploads=False, reinstall_plugins=False,
    ))

    assert result.success, result.errors
    owners = {(c.args[1], c.args[2]) for c in chown.call_args_list}
    assert owners == {(old.st_uid, old.st_gid)}