import unittest

from backend.agent_tools import classify_kubectl_command, parse_kubectl_command


class KubectlCommandPolicyTest(unittest.TestCase):
    def test_allows_read_only_kubectl_command_for_autonomous_execution(self):
        decision = classify_kubectl_command("kubectl get pods -n production -o wide")

        self.assertEqual(decision.mode, "read")
        self.assertFalse(decision.requires_approval)

    def test_requires_approval_for_mutating_kubectl_command(self):
        decision = classify_kubectl_command("kubectl rollout restart deployment/api -n production")

        self.assertEqual(decision.mode, "write")
        self.assertTrue(decision.requires_approval)

    def test_rejects_shell_operators_and_non_kubectl_commands(self):
        for command in (
            "kubectl get pods; rm -rf /",
            "kubectl get pods | sh",
            "bash -c kubectl get pods",
            "sudo kubectl get pods",
        ):
            with self.subTest(command=command):
                with self.assertRaises(ValueError):
                    parse_kubectl_command(command)

    def test_rejects_exec_even_when_command_looks_read_only(self):
        decision = classify_kubectl_command("kubectl exec api-0 -- cat /etc/hosts")

        self.assertEqual(decision.mode, "write")
        self.assertTrue(decision.requires_approval)


if __name__ == "__main__":
    unittest.main()